docs(plugin-security): name the drop-gate refusal as the source of the 18.0 sentence in the changeset and the pin's comment

The sentence the unnamed-grant line now ends with is the one the drop-gate
refusal of `os migrate apply --allow-destructive` carries; the boot refusal and
the command's own refusal say the same in their own terms. The changeset and the
pin's comment said "the 18.0 refusals share" it. The changeset also describes
the removed grant-again warning as it was worded. No code or assertion moves.

Claude-Session: https://claude.ai/code/session_01LR1cD9JqgkeqY7k9rrZH8s
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/24652-report-v18-upgrade-text.md

@@ -6,6 +6,6 @@ fix(plugin-security): the boot report's unnamed-grant line says what 18.0 suppor
 
 Clause-②: no
 
-- **The error line for `sys_user_permission_set` grants whose `permission_set` is empty** used to end with a fix: plan with `os migrate organization-ownership --out plan.json`, then run `os migrate organization-ownership --apply --backup-taken --plan-file plan.json`, restart, and do not grant the set again by name before then. 18.0 refuses that command on every database, so the operator was sent to a refusal. The line now ends with the sentence the 18.0 refusals share: "18.0 supports fresh installs only and does not upgrade a v17 database: keep a v17 database on a 17.x release until the 18.x release that carries the upgrade path."
+- **The error line for `sys_user_permission_set` grants whose `permission_set` is empty** used to end with a fix: plan with `os migrate organization-ownership --out plan.json`, then run `os migrate organization-ownership --apply --backup-taken --plan-file plan.json`, restart, with a warning that granting the set again by name before it runs leaves a second grant for the ceremony to report. 18.0 refuses that command on every database, so the operator was sent to a refusal. The line now ends with the sentence the drop-gate refusal of `os migrate apply --allow-destructive` carries: "18.0 supports fresh installs only and does not upgrade a v17 database: keep a v17 database on a 17.x release until the 18.x release that carries the upgrade path."
 - **Unchanged:** the count, the "permission_set is empty" fact, the ADR-0131 D4 reason ("each confers nothing"), "Nothing was changed.", the structured meta, the log level and the report's result. Such a grant still confers nothing and is still listed.
 - **Removed from the line:** the two command steps and the restart step, and the advice about granting the set again by name. They described the 18.x upgrade ceremony, which 18.0 does not carry.

packages/plugins/plugin-security/src/catalog-reference-report.test.ts

@@ -326,9 +326,11 @@ describe('[ADR-0131 D4] the unnamed-grant line says what 18.0 supports for a v17
   // The one wording pin in this file. 18.0 supports fresh installs only and its
   // `os migrate organization-ownership` refuses plan and apply on every
   // database, so the line an operator reads at boot must not send them to it;
-  // it carries the sentence the drop-gate refusal, the boot refusal and the
-  // command's own refusal carry. Everything else in the line is the report's
-  // own: the count, the field, the D4 reason, and that nothing was changed.
+  // it carries the sentence the drop-gate refusal of `os migrate apply
+  // --allow-destructive` carries (the boot refusal and the command's own
+  // refusal say the same in their own terms). Everything else in the line is
+  // the report's own: the count, the field, the D4 reason, and that nothing was
+  // changed.
   const V17_SENTENCE = '18.0 supports fresh installs only and does not upgrade a v17 database: keep a v17 database on a '
     + '17.x release until the 18.x release that carries the upgrade path.';