feat(offers): 補齊 provider-verification 可見性缺口——子端點過濾與預約入口檢查

實作 openspec change provider-verification-gaps（8/8 tasks）：
- schedules/reviews publicList 套用 visibleToPublic，隱藏課程回 404
- MemberBookingController::store Layer 1 擋未驗證教練課程的新預約（422）
- 政策：教練被取消驗證只擋新預約，既有 pending/confirmed/completed 照常
- 主規格 Notes 已知限制轉為正式 Requirements
- 測試 +5（可見性子端點 3、預約入口 2），既有 booking/review 測試 helper
  補 verified ProviderProfile
- 容器內全套件 151 passed / 388 assertions；另以 demo 資料端到端驗證
  （已驗證教練 200/200/200、未驗證 404/404/404）

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/Feature/DivingOfferVisibilityTest.php

@@ -98,6 +98,33 @@ class DivingOfferVisibilityTest extends TestCase
             ->assertJsonPath('data.title', 'Visible Course');
     }
 
+    // ── 公開子端點套用相同可見性 ─────────────────────────────
+
+    public function test_schedules_endpoint_returns_404_for_unverified_provider_offer(): void
+    {
+        $unverified = $this->makeProvider(false);
+        $offer = $this->makeOffer($unverified->id, 'Hidden Schedules Course');
+
+        $this->getJson("/api/diving-offers/{$offer->id}/schedules")->assertStatus(404);
+    }
+
+    public function test_reviews_endpoint_returns_404_for_unverified_provider_offer(): void
+    {
+        $unverified = $this->makeProvider(false);
+        $offer = $this->makeOffer($unverified->id, 'Hidden Reviews Course');
+
+        $this->getJson("/api/diving-offers/{$offer->id}/reviews")->assertStatus(404);
+    }
+
+    public function test_sub_endpoints_work_for_verified_provider_offer(): void
+    {
+        $verified = $this->makeProvider(true);
+        $offer = $this->makeOffer($verified->id, 'Visible Sub Course');
+
+        $this->getJson("/api/diving-offers/{$offer->id}/schedules")->assertOk();
+        $this->getJson("/api/diving-offers/{$offer->id}/reviews")->assertOk();
+    }
+
     // ── 驗證狀態切換立即生效（快取失效） ─────────────────────
 
     public function test_toggle_verified_takes_effect_immediately_despite_cache(): void