docs(core): replace the dangling SECURITY_FIX_SUMMARY @see with its rationale

`SimpleExpressionEvaluator`'s doc block pointed at
https://github.com/objectstack-ai/objectui/blob/main/SECURITY_FIX_SUMMARY.md.
That file was deleted in ea72f18 — a 20-file bulk removal of the root-level
PR #300 / v0.4.0 summaries, 6742 deletions and zero insertions, so the content
was dropped outright rather than migrated. The link has 404'd since.

Reading `git show ea72f18^:SECURITY_FIX_SUMMARY.md` shows the doc block
already repeats most of what it carried (the operator list, the LIMITATIONS
list verbatim). One thing it carried is NOT in the doc block and is
load-bearing: the parser exists because CodeQL flagged the previous
`new Function(...contextKeys, "'use strict'; return (…)")` as "Unsafe code
constructed from library input". That makes the ban on dynamic code execution
a remediation constraint a future maintainer must not trade away for
expressiveness or speed, not a style preference. That sentence is now inline,
and the provenance points at the immutable git object instead of a `main` blob
path that no longer resolves.

Comment-only: `SimpleExpressionEvaluator` is not exported, so nothing changes
in the emitted `.d.ts`, and no behaviour, type or API surface moves.

Author: claude

.changeset/issue-6275-validation-engine-dangling-see.md

@@ -0,0 +1,7 @@
+---
+---
+
+Comment-only change in `@object-ui/core`: the `SimpleExpressionEvaluator` doc block
+no longer points at the deleted `SECURITY_FIX_SUMMARY.md`, and states the security
+rationale inline instead. Releases nothing — the class is not exported, so the doc
+block reaches no `.d.ts`, and no behaviour, type or API surface changes.

packages/core/src/validation/validators/object-validation-engine.ts

@@ -199,7 +199,15 @@ export interface ValidationExpressionEvaluator {
  * Simple expression evaluator using a simple parser (no dynamic code execution)
  *
  * SECURITY: This implementation parses expressions into an AST and evaluates them
- * without using eval() or new Function(). It supports:
+ * without using eval() or new Function(). That is a remediation, not a style
+ * preference: an earlier revision compiled the predicate with
+ * `new Function(...contextKeys, "'use strict'; return (" + expression + ")")`,
+ * and CodeQL flagged it as "Unsafe code constructed from library input" —
+ * expressions reach this class from validation metadata, so that shape is a
+ * code-injection vector in any consumer that renders metadata it does not
+ * control. Never reintroduce eval(), new Function() or any other dynamic-code
+ * path here to buy expressiveness or speed; extend the parser, or inject a
+ * richer evaluator through the constructor (see NOT CEL below). Supports:
  * - Comparison operators: ==, !=, >, <, >=, <=
  * - Logical operators: &&, ||, !
  * - Property access: record.field, record['field']
@@ -218,7 +226,10 @@ export interface ValidationExpressionEvaluator {
  * pre-check agree with the server on richer predicates, pass a CEL-backed
  * `ValidationExpressionEvaluator` to the constructor.
  *
- * @see https://github.com/objectstack-ai/objectui/blob/main/SECURITY_FIX_SUMMARY.md
+ * The write-up this block used to link to (`SECURITY_FIX_SUMMARY.md`) was
+ * deleted with no successor; its load-bearing reasoning is inline above, and
+ * the original text remains readable at
+ * `git show ea72f1886^:SECURITY_FIX_SUMMARY.md`.
  */
 class SimpleExpressionEvaluator implements ValidationExpressionEvaluator {
   evaluate(expression: string, context: Record<string, any>): any {