fix(service-automation, objectql): keep each message's literal-piece count unchanged

The reworded texts now span the same number of concatenated template
pieces and source lines as before, so a projection with comments and
literal content blanked is byte-identical to the base for every changed
file.

Claude-Session: https://claude.ai/code/session_01WkL6Eijt432S1Y7ekb6ovQ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/objectql/src/hook-run-as.ts

@@ -117,10 +117,8 @@ export class HookUnscopedDataAccessError extends Error {
       .join(', ');
     super(
       `[runAs] refusing a data operation (${where}): this hook's runAs is 'user' but no trigger user ` +
-        `could be resolved, so the operation cannot be restricted to a user. ` +
-        `Without one it would carry no principal: ` +
-        `refused by the security plugin where one is composed, unscoped where none is. ` +
-        `Declare \`runAs: 'system'\` on the hook to make the elevation ` +
+        `could be resolved, so the operation cannot be restricted to a user. Without one it would carry no principal: ` +
+        `refused by the security plugin where one is composed, unscoped where none is. Declare \`runAs: 'system'\` on the hook to make the elevation ` +
         `explicit and intended, or arrange for the trigger to supply a user (a write made with a system ` +
         `context carries none). Branch on \`code === '${HOOK_UNSCOPED_DATA_ACCESS_CODE}'\` (ADR-0112) ` +
         `to detect this. (ADR-0049)`,

packages/services/service-automation/src/engine.ts

@@ -6133,8 +6133,7 @@ export class AutomationEngine implements IAutomationService {
             this.logger.warn(
                 `[runAs] flow '${flow.name}' executes with runAs:'user' but its trigger resolved no user ` +
                 `— its data operations will be REFUSED. Without a user they would carry no principal: ` +
-                `refused by the security plugin where one is composed, unscoped where none is ` +
-                `(the fail-open ADR-0049 forbids). ` +
+                `refused by the security plugin where one is composed, unscoped where none is (the fail-open ADR-0049 forbids). ` +
                 `Declare runAs:'system' to make the elevation explicit and intended, or arrange ` +
                 `for the trigger to supply a user. Note a user-less trigger is NOT only a schedule: a ` +
                 `record-change flow fired by a system write carries no user either (ADR-0049).`,

packages/services/service-automation/src/runtime-identity.ts

@@ -86,10 +86,8 @@ export class UnscopedRunDataAccessError extends Error {
       .join(', ');
     super(
       `[runAs] refusing a data operation${where ? ` (${where})` : ''}: this run's effective runAs is ` +
-        `'user' but no trigger user could be resolved, so the operation cannot be restricted to a user. ` +
-        `Without one it would carry no principal: ` +
-        `refused by the security plugin where one is composed, unscoped where none is. ` +
-        `Declare \`runAs: 'system'\` on the ` +
+        `'user' but no trigger user could be resolved, so the operation cannot be restricted to a user. Without one it would carry no principal: ` +
+        `refused by the security plugin where one is composed, unscoped where none is. Declare \`runAs: 'system'\` on the ` +
         `flow to make the elevation explicit and intended, or arrange for the trigger to supply a user ` +
         `(a write made with a system context carries none). (ADR-0049)`,
     );