List every node in the space carrying its own live public share

One row per node that someone explicitly published and that is still live — scope: "public" and unexpired — joined to just enough of the node (name, slug, type, icon) to render and open it. Rows the caller cannot see are omitted (same node-visibility ACL as nodes.list), and the stored share password is never returned, only a hasPassword flag. Deliberately does NOT include nodes that are merely reachable because an ANCESTOR is shared: this is the list of grants a person made, each revocable on its own with nodes.share.disable, which is the same set the workbench sidebar marks with a globe (NodeVO.shared).