fix(core,changeset): classify the lint's referenceTargetOf() caller; the objectql changeset declares no narrowing

The [#22661] census requires a CALLERS row for every source that calls the
reference-target arbiter; validate-expressions.ts now does, as authoring-time
static analysis. The objectql changeset is a patch and narrows nothing, so its
Clause-② line carries no arm; the lint changeset names the objectExtensions
blind spot at build time.

Claude-Session: https://claude.ai/code/session_01SE5iTKQC8i5LBRywMuQZmt
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/24410-lint-formula-hop-undeclared-field.md

@@ -16,4 +16,4 @@ The field-formula pass judges the field a formula reads one hop through a refere
 - `record.book.title`, where the target declares `title`, passes as before.
 - A target the stack does not carry is not judged. At the save door the stack carries the live registry's objects in the written package's closure, so a target from a package it depends on is judged.
 
-What to do. Read a field the target declares, or declare the field on the target object. Do not declare it on the object that carries the formula.
+What to do. Read a field the target declares, or declare the field on the target object. Do not declare it on the object that carries the formula. At `os build` and `os validate` this pass does not see a target field that an `objectExtensions` entry contributes, while the save door judges the merged object.

.changeset/24410-objectql-formula-hop-sibling-isolation.md

@@ -4,7 +4,7 @@
 
 fix(objectql): a formula reading a field its reference's target does not declare no longer makes the other formulas reading through the same reference read null
 
-Clause-②: no (narrowing)
+Clause-②: no
 
 <!-- adr-0087: not-required (no-migration-prescription) Nothing an author writes, and nothing stored, is added, removed or renamed. A valid formula that read null beside a misspelt sibling now reads its value; no spec key, export, option, object definition or stored shape changes, so there is nothing for `objectstack migrate meta` to rewrite. -->
 

packages/core/src/security/second-object-read-exposure.pin.test.ts

@@ -201,6 +201,11 @@ const CALLERS: Record<string, Classification> = {
     kind: 'not-a-served-read',
     reason: 'authoring-time static analysis of metadata; reads no record',
   },
+  // [#24410] A formula's one-hop read judged against its target's declared fields.
+  'packages/lint/src/validate-expressions.ts': {
+    kind: 'not-a-served-read',
+    reason: 'authoring-time static analysis of metadata; reads no record',
+  },
   'packages/metadata-protocol/src/seed-loader.ts': {
     kind: 'not-a-served-read',
     reason: "resolves a seed's references at install, under the system identity; serves nothing to a caller",