docs(spec): regenerate the EvalUser reference page

Output of `pnpm --filter @objectstack/spec check:generated --fix`
(gen:docs only; the other 14 artifacts were already current).

Claude-Session: https://claude.ai/code/session_01GV6oYwgc1kWiUCb1YaprQ7
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

content/docs/references/identity/eval-user.mdx

@@ -70,7 +70,7 @@ const result = EvalUserSchema.parse(data);
 | **name** | `string` | optional | Display name |
 | **email** | `string` | optional | Email address |
 | **positions** | `string[]` | optional (default: `[]`) | Canonical position/identity names the user holds — built-in identity names plus sys_position assignments, scope-resolved (ADR-0068 D3). The security axis, the same set /auth/me/permissions reports; NOT the better-auth user.role scalar, which remains published as user.role |
-| **isPlatformAdmin** | `boolean` | optional | DERIVED alias of 'platform_admin' in positions. Deprecated. |
+| **isPlatformAdmin** | `boolean` | optional | The PLATFORM_ADMIN standing of ADR-0095 D3: true when the platform resolves the user, per request, to the PLATFORM_ADMIN posture rung — from the deployment's declared administrator list (OS_PLATFORM_OWNER_EMAIL) under every tenancy posture, or from an unscoped admin_full_access grant under the single posture. The predicate platform-operator gates read (current_user.isPlatformAdmin == true, ADR-0068 D4). The resolver projects 'platform_admin' into positions from the same grant, so the two agree for every genuine administrator; gate on this key, never on the positions array. |
 | **organizationId** | `string \| null` | optional | Active organization ID (null = platform/unscoped) |