activitypub: short-circuit is_public?() with directMessage flag check