chore: changeset and regenerated sharing reference for the one anonymous-intake rule

Claude-Session: https://claude.ai/code/session_018zT8d8NpiQ1ExhuNd5TxY6
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/public-form-withdrawal-one-rule.md

@@ -0,0 +1,7 @@
+---
+'@objectstack/metadata-core': patch
+'@objectstack/metadata-protocol': patch
+'@objectstack/rest': patch
+---
+
+Public forms: every declared means of withdrawing a form from anonymous intake is now honoured by every anonymous form door. Which forms a `view` opens to anonymous intake is now decided by one rule, `anonymousFormIntakeCandidates` (new in `@objectstack/metadata-core`, alongside `anonymousFormIntakeSlugs`, `anonymousFormIntakeSlug` and `publicFormSlug`), read by both the anonymous form endpoints in `@objectstack/rest` and the organization-scoped `view` write check in `@objectstack/metadata-protocol`, so the two can no longer disagree. A form is served anonymously only when its `sharing` config declares public sharing as `SharingConfigSchema` defines it; see the public forms guide for the required keys.

content/docs/references/ui/sharing.mdx

@@ -17,9 +17,10 @@ asymmetry survives as the reason this file reads the way it does:
 
 - `SharingConfigSchema` has a **live authoring door**. `FormViewSchema.sharing`
   carries it (`view.zod.ts`), `view` is a metadata-type root, and the runtime
-  really reads it: `rest-server.ts` mounts the anonymous form endpoints only
-  when `sharing.allowAnonymous === true` and a `sharing.publicLink` slug
-  matches. Both example apps author it (`app-showcase` `inquiry.view.ts`,
+  really reads it: `rest-server.ts` serves the anonymous form endpoints only
+  when `sharing.enabled === true`, `sharing.allowAnonymous === true` and a
+  `sharing.publicLink` slug matches (`anonymousFormIntakeCandidates` in
+  `@objectstack/metadata-core`). Both example apps author it (`app-showcase` `inquiry.view.ts`,
   `app-crm` `lead.view.ts`). It is `strictObject` as of #4001 批 14.
 - `EmbedConfigSchema` was **REMOVED** at #5015 (ADR-0049 enforce-or-remove) —
   see the block below where it stood.