docs(adr-0029): the OS_METADATA_WRITABLE anchor names the file that holds the one reader (#22442)

Refs #22411

## What

This is a path-only symbol-anchor correction in
`docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md`
(D9.6). Exactly one anchor changes:

- from `packages/metadata-protocol/src/protocol.ts#OS_METADATA_WRITABLE`
- to
`packages/metadata-protocol/src/sys-metadata-repository.ts#OS_METADATA_WRITABLE`

The sentence and the rest of the ADR are unchanged.

## Why

PR #22440 gives `OS_METADATA_WRITABLE` one reader. The protocol's
`envWritableTypes()` now delegates to the repository's
`envWritableMetadataTypes()`, so `protocol.ts` no longer spells the
variable. On that PR's head the anchor stopped being found: `Lint & Repo
Gates`, step "ADR symbol anchors resolve", reports `[unresolved-symbol]
docs/adr/0029-…md:605`. The anchor now names the file that holds the
reader. That file already carries the literal on `main`
(`readEnvWithDeprecation('OS_METADATA_WRITABLE', [])`), so the anchor
holds on `main` today and after PR #22440 lands. It is a separate PR
because `docs/adr/**` is Tier H. PR #22440 and its branch are untouched.

## Verification

- This branch (head 4bc9fe8, off `main` 081e6a0) gives exit 0 on all
three of:
- `node scripts/check-adr-symbol-anchors.mjs`: 2232 anchors across 141
records;
  - `pnpm check:adr-anchors`;
  - `pnpm check:nul-bytes`.
- Throwaway local merge: this branch with PR #22440's head `adbb0a550`
(`git merge --no-commit --no-ff`, aborted afterwards, never pushed).
`node scripts/check-adr-symbol-anchors.mjs` exits 0 there.
- Control: the same checker on PR #22440's head alone exits 1 with the
`[unresolved-symbol] … protocol.ts#OS_METADATA_WRITABLE` line, so the
probe is able to fail.
- Gates: `node scripts/pm/dispatch-gates.mjs --repo
objectstack-ai/objectstack --commands` derives 19 commands, and all 19
exit 0. `check:doc-formula-expressions` first answered PREREQUISITE NOT
MET (exit 3) and exits 0 after building `@objectstack/formula` and
`@objectstack/lint`. `--ran` reports 19 derived, 19 run, 0 NOT-MEASURED,
0 UNRUN.
- No changeset: `docs/adr/**` publishes nothing.

## Acceptance notes

- The sentence this anchor sits in (D9.6) says the operator hatch "is
the same one door as before, and it now has to stay open for the life of
the customization". Since ADR-0131 D6, the hatch no longer opens an
overlay write to an item a managed package ships. So the sentence may
have become untrue, and that is not a pointer problem. Following the
anchor gate's own rule ("Do not repair prose to clear this gate"), it is
left as written and reported to the seat on the card. Who takes it up:
nobody yet.

## 维护者速读(草稿)

**改了什么**:ADR-0029 里有一处指向代码的“锚点”,原来指向 `protocol.ts`,现在改为指向
`sys-metadata-repository.ts`。只改这一个文件路径,ADR 的正文论述一个字没动。

**为什么改**:PR #22440 把 `OS_METADATA_WRITABLE`
这个运维开关统一成只由一个地方读取(仓储层)。`protocol.ts` 里不再出现这个变量名,ADR
的锚点因此失效,门禁变红。锚点改为指向现在真正读取这个开关的文件。

**风险与代价(含回滚)**:不影响任何运行时行为,也不发布任何包。回滚就是撤销这一行改动。注意:锚点只有在 PR #22440
合入后才必须改;在 `main` 上,新旧两个路径现在都能通过门禁。

**席位意见**:

**你要做的**:这是 Tier H 文件(`docs/adr/**`),需要您批准或亲手合入。建议与 PR #22440
同时或先于它合入,否则 PR #22440 的 `Lint & Repo Gates` 会一直红。另请留意上方 Acceptance
notes:D9.6 那句关于运维开关的描述,在 ADR-0131 D6 之后可能已经不再成立,是否修订正文需要您另行决定。

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Bw3y2DWhT9RPnrmDsNqEVG)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md

@@ -602,7 +602,7 @@ evidence it admits every subsequent write through the `allowRuntimeCreate` tier.
 So this is the declared contract being enforced consistently, not a new
 restriction; but a deployment that has been living in the post-first-write state
 will see writes start being refused. The documented operator hatch
-(`OS_METADATA_WRITABLE=object`, `packages/metadata-protocol/src/protocol.ts#OS_METADATA_WRITABLE`) is the same one door as
+(`OS_METADATA_WRITABLE=object`, `packages/metadata-protocol/src/sys-metadata-repository.ts#OS_METADATA_WRITABLE`) is the same one door as
 before, and it now has to stay open for the *life* of the customization rather
 than only for its first save. Deployments that cannot accept that must move the
 customization into a package — which is the position ADR-0005's whitelist has