test(dogfood): catalogPermissionSet answers any, as the findOne it replaces did (#15204 stage 6b-2, T2)

Claude-Session: https://claude.ai/code/session_013XKtmoR5QCUSTMjiQ3os49
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/qa/dogfood/test/catalog-permission-set.ts

@@ -14,10 +14,11 @@
 
 import { securityCatalogReaderOf } from '@objectstack/core';
 
-export async function catalogPermissionSet(
-  ql: unknown,
-  name: string,
-): Promise<Readonly<Record<string, unknown>> | undefined> {
+/**
+ * Typed `any`, as the `ql.findOne` it replaces at every call site was: a fixture
+ * asserts the definition exists and then reads its fields.
+ */
+export async function catalogPermissionSet(ql: unknown, name: string): Promise<any> {
   const reader = securityCatalogReaderOf(ql);
   if (!reader) throw new Error('no security catalog is bound to this engine — is the SecurityPlugin booted?');
   return (await reader.resolve('permission', name))?.definition;