fix(lint): the dimension refusal says a selecting report gets the refusal, not that nothing can select it

Claude-Session: https://claude.ai/code/session_01Sfe5YjBLwB9J3y8fvm2xq1
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/20890-dataset-dimension-json-stored-refused.md

@@ -8,7 +8,7 @@ Clause-②: no (a lint verdict widens its refusals; no published payload gains a
 
 <!-- adr-0087: not-required (no-migration-prescription) a refusal of a grouping TARGET at authoring time: a dataset dimensions entry whose field resolves to a declared structured-JSON field (json, composite, repeater, record, location, address, vector) or multi-value field (multiselect, checkboxes, tags, or a select, radio, lookup, user, file or image declared multiple: true). It is the authoring leg of the analytics door that already refuses every query grouping by such a column with 400 INVALID_FIELD, and that door's own changeset declared this category for this surface. No authorable key, spelling, export or stored shape moves: DatasetSchema keeps parsing every dimension, no stored row is read or rewritten, and which scalar part of a document, or which member of a list, an author meant to group on is not something a ledger entry can rewrite. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id covers a grouping target, and dataset-measure-aggregate-field-type-refused says in its own reason that a field used as a DIMENSION is untouched (not already-registered); and the change is a rule verdict, not a declaration (not runtime-interface-only or type-surface-only). -->
 
-**BREAKING**: metadata that passed `os validate`, `os build` and `os lint` can now fail, and so can a runtime dataset save (Studio, REST `/meta`, MCP), which runs the same rule. A dataset dimension is a group key, and the analytics door refuses a query that groups by a JSON-stored column with `400 INVALID_FIELD` before any SQL is built, so such a dimension could be declared and never selected. The new rule `dimension-json-stored-field-refused` (gating, `error`) refuses it where the author writes it. It ships as `minor` under the launch-window convention for accept-set narrowings. No export is removed; the `rule` member of `DatasetMeasureAggregateFinding` gains the new id beside `measure-aggregate-field-type-refused`.
+**BREAKING**: metadata that passed `os validate`, `os build` and `os lint` can now fail, and so can a runtime dataset save (Studio, REST `/meta`, MCP), which runs the same rule. A dataset dimension is a group key, and the analytics door refuses a query that groups by a JSON-stored column with `400 INVALID_FIELD` before any SQL is built, so such a dimension could be declared but never served. The new rule `dimension-json-stored-field-refused` (gating, `error`) refuses it where the author writes it. It ships as `minor` under the launch-window convention for accept-set narrowings. No export is removed; the `rule` member of `DatasetMeasureAggregateFinding` gains the new id beside `measure-aggregate-field-type-refused`.
 
 **What is refused.** A dimension whose `field` resolves, on the dataset's object or across its join chain, to a field declared with a structured-JSON type (`json`, `composite`, `repeater`, `record`, `location`, `address`, `vector`) or a multi-value declaration (`multiselect`, `checkboxes`, `tags`, or a `select`, `radio`, `lookup`, `user`, `file` or `image` declared `multiple: true`). The two classes are `@objectstack/spec/data`'s `STRUCTURED_JSON_TYPES` and `isMultiValueField`, the predicates the analytics door reads.
 

packages/lint/src/validate-dataset-measure-aggregates.ts

@@ -330,7 +330,8 @@ export function validateDatasetMeasureAggregates(stack: unknown): DatasetMeasure
         `${declarerOf(verdict, object)} declares as ${declaredAs(shape)} — `;
       const door =
         'The analytics door refuses every query that groups by this dimension with ' +
-        '`400 INVALID_FIELD` before any SQL is built, so no report or dashboard can select it.';
+        '`400 INVALID_FIELD` before any SQL is built, so a report or dashboard that selects it gets ' +
+        'that refusal instead of an answer.';
       findings.push({
         severity: 'error',
         rule: DIMENSION_JSON_STORED_FIELD_REFUSED,