fix(cli): read the objectql slot through its IObjectQLEngine contract, not any (#5081)

The ADR-0120 D5e advisory's `SchemaStack.allObjects()` erased its
service-lookup result to `any`, which `no-restricted-syntax` rejects
(#4168/#4176/#4251): the lookup already returns the slot's contract, and
the annotation switched that checking off while looking identical to code
that has it.

The `objectql` slot HAS a contract — `IObjectQLEngine`, whose
`registry.getAllObjects()` is exactly what this reads — so this takes the
prescription's first branch (pass the contract type) rather than the
UNCONTRACTED_SLOTS registration. Concretely it buys what the rule is for: a
rename of `registry` or `getAllObjects` now breaks this at compile time
instead of silently returning zero objects and turning the advisory mute.

`allObjects()` returns `unknown[]` accordingly; its only consumer,
`collectGlobalUniques`, already accepts `unknown`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ErbEDVAg1No9gdg1pgDAGB

Author: claude

packages/cli/src/utils/schema-migrate.ts

@@ -15,6 +15,7 @@
 import chalk from 'chalk';
 import type { ManagedDriftEntry, DriftCategory, PendingSchemaWork } from '@objectstack/driver-sql';
 import { isInPlaceSchemaWork } from '@objectstack/driver-sql';
+import type { IObjectQLEngine } from '@objectstack/spec/contracts';
 import { describeDriverConnection } from './connection-display.js';
 
 export type { PendingSchemaWork };
@@ -51,7 +52,7 @@ export interface SchemaStack {
    * this project's `objectstack.config.ts`. Read by the ADR-0120 D5e
    * unique-scope advisory; best-effort (`[]` when no ObjectQL service composed).
    */
-  allObjects: () => any[];
+  allObjects: () => unknown[];
   /**
    * Perform the deferred sync — call only once the operator has confirmed the
    * plan. Returns the work it actually ran (`[]` when nothing was deferred).
@@ -223,9 +224,14 @@ export async function bootSchemaStack(
      * marketplace packages is a strict subset. Best-effort — a stack with no
      * ObjectQL service reports none, and the advisory then simply says nothing.
      */
-    allObjects: (): any[] => {
+    allObjects: (): unknown[] => {
       try {
-        const ql: any = (kernel as any).getService?.('objectql');
+        // The `objectql` slot's contract is `IObjectQLEngine` (#4251) — read it
+        // through that rather than erasing the lookup to `any`, so a rename of
+        // `registry` / `getAllObjects` breaks this at compile time instead of
+        // silently reporting zero objects and turning the D5e advisory mute.
+        const getService = (kernel as { getService?: (name: string) => unknown })?.getService;
+        const ql = getService?.call(kernel, 'objectql') as IObjectQLEngine | undefined;
         return ql?.registry?.getAllObjects?.() ?? [];
       } catch {
         return [];