chore(spec): record the plugin-sharing organization-refusal MATCH as a provenance waiver (#14937)

`check:error-code-provenance` scans for `constdef` stamp sites and cannot tell
a package that RECOGNISES a registered code from one that EMITS it. The
per-grant catch added for #14754 spells the engine's refusal code once, as
`ENGINE_ORGANIZATION_REFUSAL_CODE`, and compares an incoming `err.code`
against it — the gate reads that as an unlisted stamp site under
`@objectstack/plugin-sharing`.

Adjudicated on #14937 (maintainer ruling A, 2026-09-04): record it as a
`PROVENANCE_WAIVERS` row naming `@objectstack/objectql` — the real emitter,
whose owner key already carries the code (#8844) — rather than widening the
gate or evading it with a bare inline literal. The row comes out together with
the stamp site when #14936 lands and objectql publishes a recognizer.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WXyGTWPbbreqXow7Z2pZCk

Author: claude

packages/spec/src/api/error-code-ledger.zod.ts

@@ -1181,6 +1181,21 @@ export const PROVENANCE_WAIVERS: readonly ProvenanceWaiver[] = [
       'protocol layer — the registered emitter — turns it into the 403 the wire carries ' +
       '(ADR-0010 §3.3). Spec ships schemas and pure helpers, never an HTTP door.',
   },
+  {
+    package: '@objectstack/plugin-sharing',
+    code: 'ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED',
+    registeredUnder: '@objectstack/objectql',
+    reason: 'Matches the code, never emits it (#14754, adjudicated on #14937 — maintainer ' +
+      'ruling A, 2026-09-04): `ENGINE_ORGANIZATION_REFUSAL_CODE` in ' +
+      '`plugin-sharing/src/sharing-rule-service.ts` is a `constdef` the per-grant catch in BOTH ' +
+      'reconcile loops compares an incoming `err.code` against, so exactly one engine refusal is ' +
+      'absorbed and a refused grant no longer aborts the pass or its stale-row revocations. The ' +
+      'emitter is `@objectstack/objectql` (`SystemWriteOrganizationRequiredError`, ' +
+      'tenancy/system-write-organization.ts) and the objectql owner key already carries the row ' +
+      '(#8844). Recognising a code is not emitting it; the named constant is typed FROM the ' +
+      'engine\'s own declaration so it cannot drift from what the engine throws. Removed together ' +
+      'with the stamp site when #14936 lands and objectql publishes a recognizer.',
+  },
   {
     package: '@objectstack/types',
     code: 'VALIDATION_FAILED',