test(plugin-approvals): pin the registered picker filter literally; add the changeset

The registered-body pin compared the registered field with the source field,
so dropping the filter left both undefined and the pin green. It now compares
with the literal filter.

Claude-Session: https://claude.ai/code/session_01UmqzD97e14iws6hmVhgZ5y
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/24764-delegation-delegator-picker.md

@@ -0,0 +1,13 @@
+---
+'@objectstack/plugin-approvals': patch
+---
+
+fix(plugin-approvals): the out-of-office delegation form's Delegator picker offers only the signed-in user, the one delegator the server accepts
+
+Clause-②: no
+
+No accept set moves. The field gains a picker filter, which nothing on the write path reads, and the delegation write guard and `required` are unchanged.
+
+- **Before.** `sys_approval_delegation.delegator_id` was a free `sys_user` lookup, so Approvals → Delegations → New offered every user. The delegation write guard accepts one delegator on a non-system write, the acting user, so picking anyone else was refused with 403 `FORBIDDEN`.
+- **Now.** The field declares `lookupFilters: [{ field: 'id', operator: 'eq', value: '{current_user_id}' }]`. The engine resolves the placeholder against the caller on every read, so the picker's candidate query offers the signed-in user and nobody else.
+- **Unchanged.** What a write may store. A create or an update that names another delegator is still refused, and there is no admin exemption. An admin covering for an absent approver reassigns, recalls or rejects that approver's pending approvals through the approval override instead.

packages/plugins/plugin-approvals/src/sys-approval-delegation-delegator-picker.test.ts

@@ -56,6 +56,9 @@ const sysUser = {
 
 type LookupFilter = { field: string; operator: string; value: unknown };
 
+/** The one candidate the guard admits: the acting user, by id. */
+const ACTING_USER_ONLY: LookupFilter[] = [{ field: 'id', operator: 'eq', value: '{current_user_id}' }];
+
 const delegatorField = (): Record<string, any> =>
   (SysApprovalDelegation.fields as Record<string, any>).delegator_id;
 
@@ -100,12 +103,12 @@ describe('sys_approval_delegation — the Delegator picker offers only what the
     expect(field.type).toBe('lookup');
     expect(field.reference).toBe('sys_user');
     expect(field.required).toBe(true);
-    expect(field.lookupFilters).toEqual([{ field: 'id', operator: 'eq', value: '{current_user_id}' }]);
+    expect(field.lookupFilters).toEqual(ACTING_USER_ONLY);
   });
 
   it('the registered body keeps the declaration', () => {
     const registered = (engine.registry.getObject(OBJECT) as any).fields.delegator_id;
-    expect(registered.lookupFilters).toEqual(delegatorField().lookupFilters);
+    expect(registered.lookupFilters).toEqual(ACTING_USER_ONLY);
   });
 
   it.each(USERS.map((u) => [u.id]))('the picker offers %s themselves and nobody else', async (caller) => {