Upgrade to @objectstack 7.7.0 + fix metadata-spec violations

[xuyushun441-sys]

Closes the 7.6 upgrade (issue #14) and carries it forward to 7.7.0. 7.7's stricter build (ADR-0032 expression validation + rejection of unknown ObjectSchema keys) surfaced several places where the templates were authored against shapes/APIs that don't exist and silently no-op'd at runtime. All fixed here.

Changes

• Bump @objectstack/* ^7.4.1 → ^7.7.0 across all packages (+ lockfile).
• hr: moved the "employee cannot be their own manager" guard from a CEL rule (referenced the implicit id) into hr_employee.hook.ts.
• workflows → hooks: object-level workflows: [...] is not an ObjectSchema field (silently stripped → never ran). Migrated all 15 on-update stamping/status rules across 8 objects to beforeInsert/beforeUpdate hooks; date logic done in JS (also sidesteps the CEL date↔timestamp gap).
• stateMachines → validations: object-level stateMachines: {...} is likewise not a field (silently dropped → 14 lifecycle machines never enforced). Migrated to type: 'state_machine' validation rules; now enforced at runtime.
• Removed dead rollup hooks: procurement_receipt / content metric+publication / compliance_assessment rolled up via ctx.services.data, which is undefined in the hook sandbox (a nested engine write would crash QuickJS — see packages/expense/CHARTER.md). Targets documented as stored header fields.
• Fixed dangling user lookups: Field.lookup('user') → Field.lookup('sys_user') (27 fields + view refs). 'user' is not a registered object; resolving it flooded no such table: user at runtime.

Verification

• 9/9 packages build green, full tsc --noEmit clean.
• End-to-end verified in-browser on the all aggregate: hooks fire, state machines enforce illegal transitions, lookups resolve, no such table: user gone.

Known platform bugs (NOT addressed here — server-side)

• #1530 date-typed formula fields evaluate to null (CEL date↔timestamp).
• #1491 record_change flows never fire on data writes.

🤖 Generated with Claude Code