fix(spec): record the runtime uninstall door's TENANT_SCOPE_REQUIRED stamp as a provenance waiver

The DELETE /packages/:id door now answers deletePackage's organization-scope
refusal itself, before the registry is touched, with the code the protocol
registers. The door mirrors the producer; it is not a second emitter, so the
row stays under @objectstack/metadata-protocol and the stamp is waived.

Claude-Session: https://claude.ai/code/session_local_1d2a197c-c20e-4e90-9be8-413d4d432289
Co-authored-by: Claude <noreply@anthropic.com>

Author: hotlong

.changeset/20492-uninstall-refuse-before-mutate.md

@@ -1,5 +1,6 @@
 ---
 '@objectstack/runtime': patch
+'@objectstack/spec': patch
 ---
 
 fix(runtime): `DELETE /packages/:id` refuses an uninstall that names no organization before it touches the running registry (#20492)
@@ -11,3 +12,5 @@ A caller holding `manage_metadata` with no active organization — a member remo
 The door now asks the persisted delete's organization-scope question first, from the same organization value it hands `deletePackage`, and only when a persisted delete will run. The same refusal (`400 TENANT_SCOPE_REQUIRED`) now arrives before anything changes: the package stays served, listed and registered, and its stored rows are untouched. The refusal's message names what an HTTP caller can do, which is to select an organization they are a member of and retry.
 
 - **Unchanged:** a caller acting in an organization uninstalls exactly as before. A read-only package is still refused `422 WRITABLE_PACKAGE_REQUIRED` first. A host with no persisted delete (no `deletePackage` on its `protocol` service) still uninstalls from the registry alone, because there is no refusal to mirror there. The protocol keeps its own refusal as a second line.
+
+- **`@objectstack/spec`:** `PROVENANCE_WAIVERS` (the error-code ledger) gains one entry: `@objectstack/runtime` stamps `TENANT_SCOPE_REQUIRED`, which stays registered under `@objectstack/metadata-protocol`. The door mirrors `deletePackage`'s refusal and does not emit a second vocabulary. The registered code union and `ErrorCode` are unchanged.

packages/spec/src/api/error-code-ledger.zod.ts

@@ -1762,4 +1762,16 @@ export const PROVENANCE_WAIVERS: readonly ProvenanceWaiver[] = [
       'constructor there is one stamp site, and rows for packages that stamp nothing ' +
       'would be the dead weight this file\'s gate refuses.',
   },
+  {
+    package: '@objectstack/runtime',
+    code: 'TENANT_SCOPE_REQUIRED',
+    registeredUnder: '@objectstack/metadata-protocol',
+    reason: 'The door mirrors the producer\'s refusal; it is not a second emitter. ' +
+      '`DELETE /packages/:id` (domains/packages.ts, `requireUninstallOrganizationScope`) asks ' +
+      '`deletePackage`\'s organization-scope question BEFORE `registry.uninstallPackage`, and ' +
+      'answers with the code `deletePackage` refuses with (#7780), so a refused uninstall ' +
+      'changes nothing (#20492). The door never sends `allTenants`, so its condition is exactly ' +
+      'the producer\'s "no organization"; the protocol keeps its own refusal as the second line ' +
+      'and stays the registered emitter.',
+  },
 ];