"Public subnet" is a route table fact, not a subnet property.
A subnet can never span Availability Zones — that's the whole point of using more than one.
AZ-a
Public subnetLoad balancer
Private app subnetCompute
Private data subnetDatabase
AZ-b
Public subnetLoad balancer
Private app subnetCompute
Private data subnetDatabase
Six subnets minimum for a genuinely resilient three-tier VPC — two AZs × three tiers, not two subnets total.
A subnet is public only because its route table sends 0.0.0.0/0 to an Internet Gateway — nothing else makes it public.