fix(cli,lint): 把消费被拒别名拼法的 fixture 改为 canonical (#5017)

#5046 把 validate-expressions / validate-security-posture 收敛为只读 spec
声明的键之后,两处 fixture 用的正是被拒的别名拼法,规则不再读它们:

- `packages/cli/test/authoring-rule-command-parity.test.ts:90` —— CI Test Core
  判红点。`validations: [{ name: 'r', expression: … }]` 里 `expression` 是
  `validation.zod.ts` 按名拒绝的四个别名之一,收敛后没人读,`expression-invalid`
  在三命令上都不再触发。改为 canonical `condition`,并补上 `type` / `message`
  让 fixture 除了那条**刻意种下的**裸引用缺陷之外完全 spec 合法 —— parity 测试
  本就该跑在 spec 合法元数据上,原来的 fixture 等于种了两个缺陷。

- `packages/lint/src/runtime-gate.test.ts:125,150` —— 这两处此前是绿的,但绿得
  没有意义:`validationRules` + `expression` 双重别名,使得"上下文里有一条坏
  验证规则"的 fixture 实际产生 0 条 finding(实测),所以 D4 那条断言
  `result.errors).toEqual([])` 通过的原因是**没有东西可减**,而不是减法正确。
  改为 canonical 后上下文真的产出 1 条 `invalid CEL predicate` finding,减法
  逻辑第一次被真正跑到 —— 且仍然通过。

全包 grep 过 `expression:` / `predicate:` / `formula:` 作 validation 键、
`criteria:` 作 sharing 键、`validationRules:`、`security: { sharingModel }`、
`reference_to` / `referenceTo`:其余命中要么是 #5046 里刻意 pin 住 schema 拒绝
的别名 fixture,要么属于本 PR 未改动的规则(`validate-rule-compilability.ts`
自己读 `validationRules`,已另开 #5096),要么是 objectql / driver 等包自己的
内部形状,与本次收敛无关。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018iARDqtrhQgz6fVHDeDkbQ

Author: claude

packages/cli/test/authoring-rule-command-parity.test.ts

@@ -87,7 +87,13 @@ const CASES: ReadonlyArray<{ rule: string; blindTo: readonly AuthoringCommand[];
     rule: 'expression-invalid',
     blindTo: ['lint'],
     stack: withBaseline({
-      objects: [{ name: 'parity_lead', label: 'Lead', sharingModel: 'private', fields: { lead_score: { type: 'number', label: 'Score' } }, validations: [{ name: 'r', expression: 'lead_score > 100' }] }],
+      // The planted defect is the BARE `lead_score` (a record-scoped predicate
+      // binds fields under `record`, so this silently evaluates to null) — not
+      // the key it is written under. Spelled `condition`, which is the only key
+      // `validation.zod.ts` declares: `expression` is one of the four names it
+      // rejects outright, so a fixture using it planted TWO defects and let the
+      // rule under test read a stack `os validate` would never accept (#5017).
+      objects: [{ name: 'parity_lead', label: 'Lead', sharingModel: 'private', fields: { lead_score: { type: 'number', label: 'Score' } }, validations: [{ type: 'script', name: 'r', message: 'Score out of range', condition: 'lead_score > 100' }] }],
     }),
   },
   {

packages/lint/src/runtime-gate.test.ts

@@ -122,7 +122,12 @@ describe('runtime publish gate (#4463)', () => {
       {
         name: 'leave_request',
         fields: { owner: { type: 'text' } },
-        validationRules: [{ name: 'bad', expression: 'record.owner ==', message: 'x' }],
+        // Spelled with the two keys the spec declares (`validations` /
+        // `condition`). Written as `validationRules` / `expression` — both
+        // rejected aliases — the broken CEL was not reachable by the rule at
+        // all, so this fixture proved the subtraction worked by having nothing
+        // to subtract (#5017).
+        validations: [{ type: 'script', name: 'bad', message: 'x', condition: 'record.owner ==' }],
       },
     ];
 
@@ -147,7 +152,12 @@ describe('runtime publish gate (#4463)', () => {
       {
         name: 'leave_request',
         fields: { owner: { type: 'text' } },
-        validationRules: [{ name: 'bad', expression: 'record.owner ==', message: 'x' }],
+        // Spelled with the two keys the spec declares (`validations` /
+        // `condition`). Written as `validationRules` / `expression` — both
+        // rejected aliases — the broken CEL was not reachable by the rule at
+        // all, so this fixture proved the subtraction worked by having nothing
+        // to subtract (#5017).
+        validations: [{ type: 'script', name: 'bad', message: 'x', condition: 'record.owner ==' }],
       },
     ];
     const result = runRuntimeAuthoringRules({