Visibility controls who can see a given error metadata field.

Visibility is an exposure contract for shared descriptors. It is not a secrecy boundary for data encoded in proto annotations: anyone with the descriptor can read those keys and values. Internal-only metadata belongs in runtime enrichment, observability pipelines, or internal-only overlays.

Code generators should reject UNSPECIFIED for emitted error details.