docs(permissions): isSystem 行为全集权威表 —— 按普查而非回忆构建 (#6782) (#6891)

新增 `content/docs/permissions/system-context.mdx`,作为 `ExecutionContext.isSystem`
的唯一权威页:全仓普查 1179 处 `isSystem`,分类后得到 **80 处真正改变行为的读取点、
横跨 18 个包**,逐行给出 file:line 锚点,并按「作者得到什么 / 失去什么」而非「代码在哪」
描述每一行。

内容分五个车道(授权与作用域 / 写入管线与完整性 / sharing / 审批·报表·附件·评论·知识 /
action·元数据面·provenance),另加两节同等重要的内容:

- **`isSystem` 不做什么**:不抑制触发器(那是 `skipTriggers`)、不跳过状态机、
  不跳过校验规则、不保留 `updated_at`(那是 `preserveAudit`)、不豁免 last-admin 闸门、
  不可由客户端设置 —— 每条都带锚点。
- **已知粗糙处**:5 条,明确记录而不抹平(详见 PR 说明)。

同时按裁决(#4707,2026-08-06)把「⛔ 不拆分该 flag」写入表内作为已知决定。

⛔ 无行为变更;未碰 `docs/adr/**` 与 `content/docs/releases/`。


Claude-Session: https://claude.ai/code/session_01F8q5J1MQyocgtNspb15fSn

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-project-manager

.claude/workflows/docs-accuracy-audit.js

@@ -158,6 +158,7 @@ const ALL_HANDWRITTEN = [
   "content/docs/permissions/rls.mdx",
   "content/docs/permissions/sharing-rules.mdx",
   "content/docs/permissions/sso.mdx",
+  "content/docs/permissions/system-context.mdx",
   "content/docs/plugins/adding-a-metadata-type.mdx",
   "content/docs/plugins/anatomy.mdx",
   "content/docs/plugins/development.mdx",

content/docs/permissions/authorization.mdx

@@ -233,7 +233,9 @@ one of two doors, each writing only what it owns:
   **overlay** — the record projects the effective body while the package keeps
   owning the row, and "delete" resets to the shipped declaration. System /
   boot writes carry `isSystem` and bypass it, so the seeder and materializer
-  are never self-blocked.
+  are never self-blocked. That bypass is not local to this gate — the full set
+  of behaviours the flag changes is catalogued in
+  [System Context (`isSystem`)](/docs/permissions/system-context).
 
 ## Lifecycle coverage (five stages)
 

content/docs/permissions/meta.json

@@ -6,6 +6,7 @@
     "authentication",
     "sso",
     "authorization",
+    "system-context",
     "profiles",
     "permission-sets",
     "positions",