chore: neutral wording for the walled public form pins and changeset

Claude-Session: https://claude.ai/code/session_018zT8d8NpiQ1ExhuNd5TxY6
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/21468-walled-public-form-withdrawal.md

@@ -2,4 +2,4 @@
 '@objectstack/metadata-protocol': patch
 ---
 
-An organization-scoped save that changes which public forms accept anonymous intake is now refused (`403 NOT_OVERRIDABLE`) when the anonymous form doors never read that organization, as on a walled tenancy posture (degraded or not), where an anonymous request resolves no organization. The message names the reason and the remedy: save the change env-wide, which withdraws or publishes the form on every anonymous door. Drafts and draft promotion are refused alike. Organization-scoped edits that leave a form's anonymous intake as the env-wide definition has it, env-wide saves, and single-posture deployments are unchanged.
+Withdrawing or publishing a public form on a walled tenancy posture (degraded or not) is now refused loudly at authoring, with `403 NOT_OVERRIDABLE`, when the save is organization-scoped and the anonymous form doors cannot honour it. The message names the remedy: save the change env-wide, which every anonymous door honours. Drafts and draft promotion are refused alike. Other organization-scoped edits, env-wide saves and single-posture deployments are unchanged.

packages/metadata-protocol/src/protocol.ts

@@ -14529,9 +14529,7 @@ export class ObjectStackProtocolImplementation implements
      * (`registerFormEndpoints` in `@objectstack/rest`). Where that is not the
      * write's organization (every walled posture, degraded or not, answers
      * `null`; so does a composition with no tenancy service), the doors read
-     * the env-wide definition and never see this overlay. Saving it would show
-     * the author a withdrawn (or published) form while the doors kept serving
-     * the env-wide state, so the write is refused instead and the author is
+     * the env-wide definition, so the write is refused and the author is
      * pointed at the env-wide save, which every door honours.
      *
      * Judged on the anonymous slug set alone ({@link anonymousFormIntakeSlugs}):

packages/qa/dogfood/test/public-form-withdrawal-walled.dogfood.test.ts

@@ -9,11 +9,9 @@
 // and on a walled posture the engine refuses an org-less insert into one, so
 // it could not show the published side accepting intake.
 //
-// An anonymous form request carries no organization, and a walled posture
-// resolves none for it, so the anonymous form doors read the env-wide form
-// definition. An organization-scoped change to a form's anonymous intake
-// would therefore be shown in the editor and never reach a door; the save
-// door refuses it instead, naming the env-wide save as the remedy. Pinned:
+// On a walled posture the anonymous form doors read the env-wide form
+// definition, so an organization-scoped change to a form's anonymous intake is
+// refused at the save door, naming the env-wide save as the remedy. Pinned:
 //
 //   - the organization-scoped withdrawal answers `403 NOT_OVERRIDABLE` and
 //     nothing is saved (the organization still reads the published form, and