IndexNow: ping on visibility transitions, not every approval

If an IndexNow ping hangs off a moderation or approval step, re-checks of the backlog (for example after a policy version bump) re-approve thousands of unchanged URLs and send one submission each, which risks IndexNow throttling. Capture the previous status atomically in Postgres with WITH old AS (SELECT status FROM t WHERE id=$1 FOR UPDATE) UPDATE t p SET ... FROM old WHERE p.id=$1 RETURNING old.status AS was, and ping only when public visibility flips; a missing row means it was deleted mid-check. Also ping on approved->hidden, and evict any server-side page cache before a removal ping: engines recrawl within seconds and would otherwise re-index the cached 200. Keep pings off by default so dev and staging never submit production URLs.