fix(dogfood): the wall CONTROL cases' packages declare the CRM dependency and their publish lines read the receipt

The walled `CONTROL: the platform operator writes at every one of these
doors` case and the `single (CONTROL)` case each published a draft list
view bound to `crm_lead` into a package that declared no dependency on
`com.example.crm`. Under the ruled closure narrowing each publish answers
200 with `success: false, outcome: refused, publishedCount: 0`
(`list-view-object-outside-closure`), and the status-only `ok()` read it
as a write, so neither CONTROL could fail at the publish-drafts door.

Each package now declares `dependencies: { [CRM_PKG]: '*' }` at
`POST /packages`, and each publish line asserts the receipt in `data`
(`success: true`, `outcome: 'published'`, `publishedCount: 1`) with
`failed[]` as the message, the form the /packages case already uses.
The view names stay on `crm_lead`; no other line changes.

Claude-Session: https://claude.ai/code/session_01LmjU2x1faLZ39DVTFyVca6
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/qa/dogfood/test/wall-environment-metadata-refusal.dogfood.test.ts

@@ -319,10 +319,18 @@ for (const posture of ['isolated', 'group'] as const) {
       await ok(await h.stack.apiAs(h.operator, 'DELETE', `/meta/view/${name}`));
 
       const pkg = `com.em.${p}.opctl`;
-      await ok(await h.stack.apiAs(h.operator, 'POST', '/packages', { id: pkg, name: 'opctl', version: '1.0.0', type: 'app' }), 201);
+      // As in the /packages case: the package declares the CRM package, whose
+      // object the view binds, and the publish line reads the receipt, because
+      // a refused publish also answers 200.
+      await ok(await h.stack.apiAs(h.operator, 'POST', '/packages',
+        { id: pkg, name: 'opctl', version: '1.0.0', type: 'app', dependencies: { [CRM_PKG]: '*' } }), 201);
       await ok(await h.stack.apiAs(h.operator, 'PATCH', `/packages/${pkg}`, { description: 'by the operator' }));
       await ok(await h.stack.apiAs(h.operator, 'PUT', `/meta/view/crm_lead.em_${p}_pkgv?package=${pkg}&mode=draft`, view(`crm_lead.em_${p}_pkgv`, 'v1')));
-      await ok(await h.stack.apiAs(h.operator, 'POST', `/packages/${pkg}/publish-drafts`, {}));
+      const published = await h.stack.apiAs(h.operator, 'POST', `/packages/${pkg}/publish-drafts`, {});
+      await ok(published);
+      const receipt = ((await published.json()) as { data?: Record<string, unknown> }).data;
+      expect({ success: receipt?.success, outcome: receipt?.outcome, publishedCount: receipt?.publishedCount }, JSON.stringify(receipt?.failed))
+        .toEqual({ success: true, outcome: 'published', publishedCount: 1 });
       await ok(await h.stack.apiAs(h.operator, 'POST', `/packages/${pkg}/duplicate`, { targetPackageId: `com.em.${p}.opctl.copy` }));
       await ok(await h.stack.apiAs(h.operator, 'DELETE', `/packages/${pkg}`));
 
@@ -358,9 +366,16 @@ describe('[ADR-0131 D12 items 7–8 · D11] single (CONTROL): the refusal is ine
     await ok(await h.stack.apiAs(h.tokA, 'PUT', '/meta/view/crm_lead.em_sin_view', view('crm_lead.em_sin_view', 'View by A')));
     await ok(await h.stack.apiAs(h.tokA, 'PUT', '/meta/flow/em_sin_flow', flow('em_sin_flow', 'Flow by A')));
     expect(await readAsB(h, 'view', 'crm_lead.em_sin_view')).toEqual({ status: 200, label: 'View by A' });
-    await ok(await h.stack.apiAs(h.tokA, 'POST', '/packages', { id: 'com.em.sin.a', name: 'a', version: '1.0.0', type: 'app' }), 201);
+    // As in the walled /packages case: the package declares the CRM package, and
+    // the publish line reads the receipt.
+    await ok(await h.stack.apiAs(h.tokA, 'POST', '/packages',
+      { id: 'com.em.sin.a', name: 'a', version: '1.0.0', type: 'app', dependencies: { [CRM_PKG]: '*' } }), 201);
     await ok(await h.stack.apiAs(h.tokA, 'PUT', '/meta/view/crm_lead.em_sin_pv?package=com.em.sin.a&mode=draft', view('crm_lead.em_sin_pv', 'v1')));
-    await ok(await h.stack.apiAs(h.tokA, 'POST', '/packages/com.em.sin.a/publish-drafts', {}));
+    const published = await h.stack.apiAs(h.tokA, 'POST', '/packages/com.em.sin.a/publish-drafts', {});
+    await ok(published);
+    const receipt = ((await published.json()) as { data?: Record<string, unknown> }).data;
+    expect({ success: receipt?.success, outcome: receipt?.outcome, publishedCount: receipt?.publishedCount }, JSON.stringify(receipt?.failed))
+      .toEqual({ success: true, outcome: 'published', publishedCount: 1 });
     await ok(await h.stack.apiAs(h.tokA, 'DELETE', '/packages/com.em.sin.a'));
     await ok(await h.stack.apiAs(h.tokA, 'POST', INSTALL_LOCAL, packageBody('com.em.sin.il', '1.0.0', [object('em_sin_ilobj', 'v1')])));
     await ok(await h.stack.apiAs(h.tokA, 'DELETE', `${INSTALL_LOCAL}/com.em.sin.il`));