fix(cli): the walled undeclared-position remedy names no catalog the code door contradicts; the uncomposed control pins only the pointer's absence

Patch round 1 of the seat's review. 'Declare the position NAME in the
environment catalog ... through the deployment's code' said two opposite
things: the environment catalog is the environment-authored items, and a
code declaration is a package declaration. The sentence now reads
'Declare the position NAME with permissionSets naming SETS, through one
door only: ...', in the source and in the changeset's TO line.

The uncomposed-block walled control no longer pins an act for everyone:
its fake catalog declares no everyone, while a composed boot declares it
sealed. It asserts only that the pointer and the composition are gone.

Claude-Session: https://claude.ai/code/session_01Q9PZ5Pzqcus4woVvTZwWNU
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/23542-walled-binding-remedy.md

@@ -12,7 +12,7 @@ The blocker's first sentence is unchanged: "Binding rows give position NAME sets
 
 - **A position no catalog declares.**
   - FROM: "The authored-conversion step carries them; resolve its blocker, then re-run."
-  - TO: "Under the POSTURE posture no ceremony step carries binding rows (ADR-0131 D3). Declare the position NAME in the environment catalog with permissionSets naming SETS, through one door only: the deployment's code (compiled into the artifact this ceremony boots), or the metadata door as the platform administrator (PUT /api/v1/meta/position/NAME). A cold boot refuses a position name a package declares and the environment catalog also holds. Then re-run."
+  - TO: "Under the POSTURE posture no ceremony step carries binding rows (ADR-0131 D3). Declare the position NAME with permissionSets naming SETS, through one door only: the deployment's code (compiled into the artifact this ceremony boots), or the metadata door as the platform administrator (PUT /api/v1/meta/position/NAME). A cold boot refuses a position name a package declares and the environment catalog also holds. Then re-run."
 - **A declared position the metadata door reports editable, whose definition lacks some of the bound sets.**
   - FROM: the same pointer.
   - TO: "Under the POSTURE posture no ceremony step carries binding rows (ADR-0131 D3). Add MISSING to the permissionSets of the position NAME through the metadata door as the platform administrator (PUT /api/v1/meta/position/NAME), then re-run."

packages/cli/src/utils/organization-ownership-apply.test.ts

@@ -2136,7 +2136,9 @@ describe('ADR-0131 D10 --apply — a name only the uncomposed security plugin de
     `);
     const rewrite = step(await apply(catalog(), ledger(), { posture: 'isolated', securityPlugin }), 'rewrite');
     expect(blockerOf(rewrite, 'the permission set admin_full_access,')).toMatch(/or remove the grants/);
-    expect(blockerOf(rewrite, 'position everyone ')).toContain('PUT /api/v1/meta/position/everyone');
+    // Not the pointer. This fake catalog declares no `everyone` (a composed boot declares it, sealed), so which
+    // walled remedy follows is not this control's question.
+    expect(blockerOf(rewrite, 'position everyone ')).not.toMatch(/resolve its blocker/);
     expect(rewrite.blockers.join('\n')).not.toContain(COMPOSITION);
   });
 });

packages/cli/src/utils/organization-ownership-apply.ts

@@ -2003,7 +2003,7 @@ async function walledBindingRemedy(run: Run, name: string, sets: readonly string
   const entry = await resolveName(run, 'position', name);
   if (!entry) {
     return (
-      `${why} Declare the position ${name} in the environment catalog with permissionSets naming ${sets.join(', ')}, ` +
+      `${why} Declare the position ${name} with permissionSets naming ${sets.join(', ')}, ` +
       `through one door only: the deployment's code (compiled into the artifact this ceremony boots), or ${door}. A ` +
       'cold boot refuses a position name a package declares and the environment catalog also holds. Then re-run.'
     );