docs(spec): cut three census claims the cli and lint readers contradict

Contract review 5802780773 (B1): the changeset's "the runtime's collection
reader was the one that answered differently" and the spec docblock's
"every reader ... points here" and "every reader reaches it through that
one function" named no set, and the cli readers and lint's recordsOf
neither point at the rule nor reach the resolver. Deleted, with the core
header's "the one place every reader reaches that refusal through" for
the same reason. Words removed only; net prose lines -2.

Claude-Session: https://claude.ai/code/session_01Sfe5YjBLwB9J3y8fvm2xq1
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/15293-non-array-packages-refusal.md

@@ -6,7 +6,7 @@ A release artifact whose `packages` is present but is not an array (`{}`, `0`, `
 
 Clause-②: no
 
-`packages` is declared as an array of package entries (`ObjectStackDefinitionSchema.packages: z.array(ArtifactPackageSchema).optional()`), and the rule is now written down once, beside `AssembledPackageBodySchema` in `@objectstack/spec`: an absent `packages` means a single-package artifact, and any other non-array value is malformed and refused. `resolveArtifactPackageOrder` in `@objectstack/core` already refused it, and so did the i18n detector in `@objectstack/plugin-dev` and the default-permission-set reader in `@objectstack/plugin-security`. The runtime's collection reader was the one that answered differently: it handed such an artifact back unchanged and read its collections off the top level.
+`packages` is declared as an array of package entries (`ObjectStackDefinitionSchema.packages: z.array(ArtifactPackageSchema).optional()`), and the rule is now written down once, beside `AssembledPackageBodySchema` in `@objectstack/spec`: an absent `packages` means a single-package artifact, and any other non-array value is malformed and refused. `resolveArtifactPackageOrder` in `@objectstack/core` already refused it, and so did the i18n detector in `@objectstack/plugin-dev` and the default-permission-set reader in `@objectstack/plugin-security`.
 
 - **What changes**: `AppPlugin` reads its collections in `start()`, and `start()` now raises the same refusal `init()` already raised through the kernel's `manifest` service. Under `os dev`, `DevPlugin`'s child-`start()` loop logs it on its `error` line, where before the app started on its top-level collections alone. `createStandaloneStack` now refuses such an artifact while it builds the stack. Before, the refusal came later, when the app registered with the `manifest` service. `loadArtifactBundle`'s runtime-module merge reports it through its existing `warn` line and skips the merge, as it already does for a malformed `packages[]` entry. `resolveProjectDatabaseUrl` no longer reads a default datasource out of such an artifact: it declines, as it already does for any artifact it cannot read, and moves on to the next rung (the unified default database). The boot that loads the artifact then refuses it.
 - **What does not change**: an absent `packages`, and `packages: null`, still return the caller's own object by identity. A well-formed `packages[]` resolves exactly as before.

packages/core/src/artifact-packages.ts

@@ -35,8 +35,7 @@
  * - `packages` absent  → treat `manifest` (singular) as a **single-element list**.
  *
  * A `packages` that is present but is not an array takes neither branch. It is
- * refused here as `INVALID_ARTIFACT_PACKAGES`, and this function is the one
- * place every reader reaches that refusal through. The rule is stated once,
+ * refused here as `INVALID_ARTIFACT_PACKAGES`. The rule is stated once,
  * beside `AssembledPackageBodySchema` (`@objectstack/spec`, `stack.zod.ts`).
  *
  * The second branch is not a convenience: it is the term ADR-0130's whole

packages/spec/src/stack.zod.ts

@@ -1244,8 +1244,7 @@ function assembledPackageBodyShape(): Pick<typeof STACK_DEFINITION_COLLECTIONS_S
  *
  * ## A non-array `packages` is MALFORMED, not absent
  *
- * This is the single statement of the rule. Every reader of a release
- * artifact's `packages` points here and does not restate it. The key is
+ * This is the single statement of the rule. The key is
  * declared on {@link ObjectStackDefinitionSchema} as an ARRAY of
  * {@link ArtifactPackageSchema} entries, each wrapping one body of this
  * schema. It therefore has two readings:
@@ -1257,10 +1256,10 @@ function assembledPackageBodyShape(): Pick<typeof STACK_DEFINITION_COLLECTIONS_S
  * Any other value, such as `{}`, `0` or `'x'`, is neither reading. It is
  * malformed and REFUSED; it is never read as absent. `resolveArtifactPackageOrder`
  * (`@objectstack/core`) raises the refusal as `INVALID_ARTIFACT_PACKAGES`
- * (ADR-0112, `status: 422`), and every reader reaches it through that one
- * function. A reader that fell through to the artifact's top level instead
- * would answer questions about an artifact the loader refuses. One reader would
- * then boot what another refuses, which is the split this rule closes.
+ * (ADR-0112, `status: 422`). A reader that fell through to the artifact's
+ * top level instead would answer questions about an artifact the loader
+ * refuses. One reader would then boot what another refuses, which is the
+ * split this rule closes.
  *
  * ⚠️ `null` is the one value this rule does not settle. The schema's
  * `.optional()` refuses it, while the readers treat it as absent. That