fix(cli): the derived row condition keeps its value lists read-only, as the ceremony's shared constant lists need

The spec's z.input arms carry mutable string arrays; the CLI's hand-written
RowCondition had read-only ones, and the ceremony's own selectors (plan.ts
SEEDED_BY) are readonly constants. Derive the CLI type from the spec arms with
in / notIn read-only, so the merged apply step type-checks unchanged.

Claude-Session: https://claude.ai/code/session_012uFegdfR6K6uqvLzt7XsdZ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/cli/src/utils/organization-ownership-inventory.ts

@@ -98,11 +98,17 @@ export type InventoryCensus =
   | 'cloud-supplement'
   | 'host-supplement';
 
+/** Each arm of `T` with its list-valued fields read-only. */
+type ReadonlyLists<T> = T extends unknown ? { [K in keyof T]: T[K] extends ReadonlyArray<infer U> ? readonly U[] : T[K] } : never;
+
 /**
  * One condition on a row. A {@link RowPredicate} ANDs them. Spelled as data,
  * never as SQL text, so the plan binds every value and quotes every column.
+ * The spec's arms, with `in` / `notIn` read-only: the platform's rows and the
+ * ceremony's own selectors share constant value lists, and a spec-parsed row
+ * (mutable lists) is assignable to it unchanged.
  */
-export type RowCondition = OrganizationOwnershipRowCondition;
+export type RowCondition = ReadonlyLists<OrganizationOwnershipRowCondition>;
 
 export type RowPredicate = readonly RowCondition[];