fix(cli): every author-time rule that can gate runs on all three commands (#4409) - #4445

…4463) (objectstack-ai#4715)

* feat(metadata-protocol,lint): run the author-time rules at the runtime publish gate (objectstack-ai#4463)

The 26 author-time rules objectstack-ai#4409 collected behind one registry ran on `os validate`,
`os build` and `os lint` — three CLI commands. Every runtime metadata write (Studio,
REST /meta CRUD, MCP/AI authoring) reaches `saveMetaItem`, which did a per-type Zod
`safeParse` and stopped, so none of the 26 ran there. For a tenant that was not the
weakest of four doors but the only one: a sys_metadata overlay row is not in the
CLI's config file, so no command could have caught it.

Shape follows the ruling: one shared core, one runtime gate.

- Move AUTHORING_RULES (and the five rule modules that lived beside it) from
  packages/cli into @objectstack/lint; the CLI now calls the same table.
- Add the kernel-safe subpath entry @objectstack/lint/runtime, guarded by a new
  runtime-lazy-deps.test.ts: neither typescript nor sucrase loads at import or
  while gating. lazy-deps.test.ts is untouched.
- Declare `surfaces` + `runtimeTypes` / `surfaceReason` per rule, and extend the
  objectstack-ai#4445 ratchet to the new surface: a rule that answers neither fails, a gate that
  hand-wires a rule fails, a gate that does not run the core fails.
- Gate `state: 'active'` saves and the draft->active promotion for `flow` with the
  flow/approval/expression/reference families; 422 in the existing structured-issues
  envelope. Drafts pass (D1). Evaluation is differential, so only the submitted item
  can refuse its own write and stored rows are never re-judged (D4).
- Escape hatch OS_ALLOW_UNLINTED_METADATA_WRITES=1, loud on every use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Br2xsJsczFsTR9bvbh2Ny

* fix(lint,objectql): escape the fingerprint separator; widen the publish repo double (objectstack-ai#4463)

Two CI failures on the first push, both real.

1. `check:nul-bytes` — the differential evaluator's finding fingerprint used
   three BARE NUL bytes as its separator. Runtime behaviour was fine; the file
   was not: grep/ripgrep classify a file containing a raw NUL as binary and
   return zero matches for it, silently, so the module disappears from code
   search and every grep-driven lint. git never warned because it sniffs only
   the first 8000 bytes and this NUL sat at byte 5361. Particularly bad here —
   the ratchet this PR adds is itself grep-driven, and the vanishing file was
   in the package it scans. Now the escaped U+0000 form: byte-identical at
   runtime, greppable at rest. (The shorter escape is deliberately avoided —
   a following digit turns it into a legacy octal escape.) Matches the
   existing convention at packages/rest/src/rest-server.ts:1065.

2. `Test Core` — objectql's publish double stubbed `getOverlayRepo` with
   `promoteDraft` alone, so `promoteDraftForPublish` reading the pending draft
   for the gate failed with `repo.get is not a function`. The real
   `SysMetadataRepository` has `get`; the double was narrower than the contract
   it stands in for (objectstack-ai#4550's shape), so the double is what is wrong. Widened
   it. The gate is NOT made conditional on the method existing — a repo-shaped
   capability sniff would silently reopen the `?mode=draft` + `POST /publish`
   bypass this PR closes, which is worse than the TypeError.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Br2xsJsczFsTR9bvbh2Ny

* fix(metadata-protocol): exempt `os migrate meta --stored` from the authoring gate (objectstack-ai#4463)

Found while auditing every internal `saveMetaItem` caller, not from a red
build — `migrateStoredMetadata` re-saves rows that ALREADY EXIST with
`mode:'publish'`, so the new gate refused any stored row carrying a violation.

That inverts the tool and contradicts D4. The migration's job is to rewrite a
stored body into the current dialect; it is not an author publishing anything.
Refusing meant a tenant holding one pre-existing bad flow could never
canonicalize that row: the migration reported `outcome:'failed'` and left the
body in the OLDER dialect — worse than the state it was asked to improve, and
precisely the "存量行走 ADR-0087 的老路" D4 promises.

Carve-out is keyed on `source === 'migrate-stored'`, which is stated by the
SERVER and never forwarded from a request (see the provenance note at the top
of `saveMetaItem`), so no caller can spell its way past the gate — pinned by a
test that walks four near-miss spellings and expects 422 for each.

`duplicatePackage` is deliberately NOT exempt: it mints brand-new rows under
new names, and a copy of a broken flow is a new broken flow. Its per-row
failure reporting already surfaces that.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Br2xsJsczFsTR9bvbh2Ny

---------

Co-authored-by: Claude <noreply@anthropic.com>