chore(objectos): bump @objectstack 12.4 → 14.7 and refresh docs for the 13/14 releases

[os-zhuang]

Summary

Upgrades the ObjectOS runtime distribution to the latest @objectstack release train and refreshes the docs site to match the v12 / v13 / v14 release notes.

Runtime upgrade

• apps/objectos/package.json: all @objectstack/* packages pinned 12.4.0 → 14.7.0 (npm latest; the packages are version-locked as a set).
• Verified on 14.7.0:
  • objectstack compile passes, including the new ADR-0090 security-posture gate (Checking security posture (ADR-0090 D7)).
  • tsc --noEmit clean.
  • scripts/smoke-runtime.sh boots the server and /api/v1/health responds.
• The 12.1 projectResolution workaround in objectstack.config.ts is still required on 14.7 (verified: createStandaloneStack still emits projectResolution: 'none' while the validator enum only accepts required|optional|auto) — comment updated to say so.
• apps/objectos/README.md: fixed stale createObjectOSStack reference (removed in 8.0) → createStandaloneStack.

Docs refresh (English + Simplified Chinese)

Per AGENTS.md, English is the source of truth and was updated first; zh-Hans mirrors it. Other locales (de/es/fr/ja/ko) keep their derived content and await the next translation sync — only their file names/links were updated so URLs stay consistent.

• Permissions section (configure/permissions/)
  • roles.mdx renamed to positions.mdx and rewritten for Permission Model v2 (v13, ADR-0090): flat positions, business-unit hierarchy, everyone/guest audience anchors, effective-dated grants and self-service delegation (14.4), member baseline delete removal (14.2), plus a roles→positions migration table. All inbound links and meta.json updated.
  • index.mdx: layer diagram and copy use positions; private-by-default sharing note; explain-engine coverage in Diagnose & audit.
  • permission-sets.mdx: new Delegated administration (adminScope) section, isDefault (replaces isProfile), effective-dated assignments, object-qualified FLS keys (14.4 lint).
  • record-access.mdx: new Sharing model defaults section (custom objects default private since v13; read/read_write/full aliases removed), position/unit recipients, explain-engine troubleshooting.
• build/data-model.mdx: enable.* flags are now enforced gates (v14: FEEDS_DISABLED/FILES_DISABLED, opt-in files, opt-out activities/feeds), and a new Data lifecycle section (ADR-0057 lifecycle block, LifecycleService, retention overrides).
• configure/authentication.mdx: phone sign-in + SMS OTP (auth.plugins.phoneNumber, @objectstack/plugin-sms) and admin user creation / bulk import (14.3).
• configure/api-access.mdx: self-serve OAuth 2.1 for MCP clients (v13) and the scope-derived permission ceiling scope_ceiling ∩ user_grants with data:read / data:write / actions:execute (14.5).
• reference/security.mdx: authorization section restructured around Permission Model v2 (explain engine, author-time lints + access-matrix gate, delegated administration, MCP scope ceiling), auth capabilities list extended, lifecycle-declared audit retention.
• reference/cli.mdx: os db clean (14.5), security-posture compile gate, --update-access-matrix.
• reference/environment-variables.mdx: OS_TELEMETRY_DB and new Data lifecycle section with OS_LIFECYCLE_DISABLED.
• resources/changelog.mdx: new 14.x (current), 13.x, and 12.x release-train highlights; support windows and compatibility matrix moved to 14.x; version examples refreshed. resources/support.mdx version example bumped.
• Root CHANGELOG.md gains an Unreleased entry for the bump + docs refresh.

Verification

• pnpm --filter @objectos/server build / type-check / pnpm -w run smoke:runtime all pass on 14.7.0.
• apps/docs: npm run type-check (fumadocs-mdx + next typegen + tsc) and npm run build (full static production build of every locale page) pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LTAZUKc9W5BFjPtctGeZwd

---

Generated by Claude Code