fix(platform-objects): translate sys_user.role help text away from the retired Set Platform Role action (#19914)

Fixes #19897

Clause-②: no

## What changed

The `zh-CN`, `ja-JP` and `es-ES` help text for
`objects.sys_user.fields.role.help`
(`packages/platform-objects/src/apps/translations/{zh-CN,ja-JP,es-ES}.objects.generated.ts`)
still told a Setup administrator to press the "Set Platform Role" action
retired in #9968. The `en` text had already moved on twice (#17102, then
#19892/#19875) to name `OS_PLATFORM_OWNER_EMAIL` and the
`single`-posture `admin_full_access` grant, but the three translations
were never brought forward, and no i18n gate could see the drift because
the leaf carries no source-hash entry.

Retranslated the leaf in all three locales as a faithful rendering of
the CURRENT `en` text (per dispatch Zone 1), keeping code spans
verbatim: `OS_PLATFORM_OWNER_EMAIL`, `single`, `admin_full_access`,
`sys_user_permission_set`.

A repo-wide grep for the retired action's name/label across every
locale's `objects`/`metadata-forms` bundles (en included) now returns 0
hits — nothing else still references it.

## The source-hash half of the suggested fix — measured, not done, and
why

The issue's suggested shape (also in Zone 2 A2) is to also give the leaf
a source-hash entry so a future `en` change is caught. Traced and
measured, and it does not hold for a leaf that carries a genuine
translation:

- `collectFilledFromHashes`
(`packages/platform-objects/src/apps/translations/source-hash.ts`) — the
function `os i18n extract --source-hashes` calls to populate
`<locale>.source-hashes.generated.ts` — records a hash for a leaf
**only** when `value === currentSource` (it's still a literal,
untranslated copy of `en`) or `previous[path] === hash(value)` (it was
already such a copy on a prior run). A leaf holding a real translation
satisfies neither, by the mechanism's own documented design (ruling
#12069 Option A): "a leaf someone actually TRANSLATED … gets no record
and stays legacy-trusted."
- Ran `pnpm i18n:extract` after writing the three translations: it
rewrote nothing else (`git status` showed only the 3 hand-edited lines —
A3 satisfied), and it did **not** add a hash entry for this leaf,
exactly as the trace predicts.
- A2's own ablation, run for real: mutated the `sys_user.role` field's
`description` in `sys-user.object.ts`, regenerated `en` via `pnpm
i18n:extract`, and ran `pnpm check:i18n` and `pnpm
check:i18n-stale-fill`. **Both report nothing** for this leaf — 0
findings, 0 stale fills — both before and after this fix. Mutation and
regeneration were fully reverted (`git checkout HEAD --`, blob hashes
re-verified equal to `HEAD`).

So the leaf remains legacy-trusted going forward — not a regression this
PR introduces, but the pre-existing, ruled status quo for every
hand-translated leaf in the `objects` bundle (measured: 1203 in zh-CN,
1182 in ja-JP, 1173 in es-ES carry no hash and are not byte-copies of
`en`). Extending protection to genuinely-translated generated leaves
would need a new ruling in the shape of #8765/#12069, which is out of
this card's scope — full measurement and a recommendation are in the dev
report.

## Tests

- `pnpm --filter @objectstack/platform-objects build` — clean.
- `pnpm --filter @objectstack/platform-objects test` — 883/883 passed.
- `pnpm --filter @objectstack/platform-objects typecheck` — clean
(pre-existing shrink-only test-typecheck-debt entry untouched).
- `pnpm check:i18n` — OK (9/9 packages in sync).
- `pnpm check:i18n-stale-fill` — OK (0 stale fills, 0 baselined).
- Full derived gate list (`node scripts/pm/dispatch-gates.mjs
--commands`, re-derived on the final commit, `origin/main` fetched
first): 54 families, 53 ran clean, 1 (`pnpm check:dual-build-cjs-loads`)
NOT MEASURED — exits 3 PREREQUISITE NOT MET, needs a full
whole-workspace `pnpm build` unrelated to this diff's closure; CI's
`Build Core` covers it. `node scripts/check-issue-citations.mjs` (the
live command, since the derivation only reaches its `--self-test`) run
by hand: exit 0.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01TEhopqrWQYBycZzyJHpAZr)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/19897-sys-user-role-help-stale-translations.md

@@ -0,0 +1,7 @@
+---
+"@objectstack/platform-objects": patch
+---
+
+The `zh-CN`, `ja-JP` and `es-ES` help text for `sys_user.role` told a Setup administrator to press the "Set Platform Role" action retired earlier — the `en` text had already moved on (renamed to describe `OS_PLATFORM_OWNER_EMAIL` and the `single`-posture `admin_full_access` grant) but the three translations were never updated to match. Retranslated the leaf into each locale as a faithful rendering of the current `en` text, with code spans (`OS_PLATFORM_OWNER_EMAIL`, `single`, `admin_full_access`, `sys_user_permission_set`) kept verbatim.
+
+No source-hash entry was added for this leaf — measured to be architecturally unreachable for a genuinely translated (non-literal-copy) leaf under the `objects`/`metadataForms` provenance mechanism (`source-hash.ts`, ruling #12069 Option A): `collectFilledFromHashes` records a hash only when the translated value is currently a byte copy of the source, and a real translation satisfies neither `value === currentSource` nor `previous[path] === hash(value)`, so it stays legacy-trusted by the ruling's own stated design. Verified empirically: mutating the source description and re-running `pnpm i18n:extract`, `pnpm check:i18n` and `pnpm check:i18n-stale-fill` reports nothing for this leaf either before or after this fix — this class of leaf has no gate-visible staleness detection today, which is the pre-existing status quo for every hand-translated leaf in the `objects` bundle, not a regression this PR introduces.

packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts

@@ -35,7 +35,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       role: {
         label: "Rol de plataforma",
-        help: "Rol a nivel de plataforma (admin, user, …). Se establece mediante la acción Establecer rol de plataforma."
+        help: "Valor de rol heredado de better-auth (admin, user, …). ObjectStack ya no lo escribe (ADR-0068 D2). Para conceder la condición de administrador de la plataforma, incluya el correo verificado del usuario en `OS_PLATFORM_OWNER_EMAIL`; bajo la postura de tenencia `single`, una asignación sin ámbito de `admin_full_access` en `sys_user_permission_set` también la concede."
       },
       banned: {
         label: "Bloqueado",

packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts

@@ -35,7 +35,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       role: {
         label: "プラットフォームロール",
-        help: "プラットフォームレベルのロール（admin、user など）。「プラットフォームロールを設定」アクションから設定します。"
+        help: "レガシーな better-auth ロールスカラー値（admin、user など）。ObjectStack はもはやこの値を書き込みません（ADR-0068 D2）。プラットフォーム管理者権限を付与するには、そのユーザーの確認済みメールアドレスを `OS_PLATFORM_OWNER_EMAIL` に列挙してください。`single` テナンシー態勢では、`sys_user_permission_set` 内のスコープ指定なしの `admin_full_access` 割り当てでも同様にこの権限が付与されます。"
       },
       banned: {
         label: "利用停止",

packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts

@@ -35,7 +35,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       role: {
         label: "平台角色",
-        help: "平台级角色（admin、user 等）。通过“设置平台角色”操作设置。"
+        help: "遗留的 better-auth 角色标量（admin、user 等）。ObjectStack 不再写入该字段（ADR-0068 D2）。要授予平台管理员身份，请将该用户已验证的邮箱加入 `OS_PLATFORM_OWNER_EMAIL`；在 `single` 租户态势下，`sys_user_permission_set` 中一条未限定范围的 `admin_full_access` 授权同样可以赋予该身份。"
       },
       banned: {
         label: "已封禁",