wip(spec): regenerate authorable-surface and reference docs for the managedBy tombstone

Claude-Session: https://claude.ai/code/session_01D3Ur6XgfkkaDUCCTkviXAr
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

content/docs/references/security/permission.mdx

@@ -118,7 +118,7 @@ const result = AdminScopeSchema.parse(data);
 | **label** | `string` | optional | Display label |
 | **description** | `string` | optional | Human-readable description shown in Setup |
 | **packageId** | `string` | optional | [ADR-0086 D3] Owning package id for a package-shipped set (absent = env-authored); a value that disagrees with the package that ships the set, or that it is saved into, is refused by the stack schema (defineStack, os validate, os build), the package registration, and the metadata save, restore and publish doors |
-| **managedBy** | `Enum<'package' \| 'platform' \| 'user'>` | optional | [ADR-0086 D3] Record provenance: package (upgrade-owned metadata) vs platform/user (env config) |
+| **managedBy** | `never` | optional | [REMOVED] `permission.managedBy` was removed in @objectstack/spec 18 (ADR-0049 enforce-or-remove, ADR-0086 D3) — nothing ever read the authored key: no seeder, package upgrade or lock consulted it, so `package` never made a set upgrade-owned and `platform` or `user` never shielded one from an upgrade. Delete the key; a set's provenance is the package that ships it, decided from that package's artifact and recorded as `packageId`, and a set created in this environment carries neither. Run `os migrate meta --from 17` to list the mechanical edits for existing sources; `--write` applies the ones it can prove, and you apply the rest by hand. |
 | **isDefault** | `boolean` | optional (default: `false`) | [ADR-0090 D5] App baseline for the everyone position: app-level sets are auto-bound at boot (guarded, idempotent); package-level sets become install-time suggestions an admin confirms |
 | **objects** | `Record<string, { allowCreate?: boolean; allowRead?: boolean; allowEdit?: boolean; allowDelete?: boolean; … }>` | ✅ | Entity permissions |
 | **fields** | `Record<string, { readable?: boolean; editable?: boolean }>` | optional | Field level security |

packages/spec/authorable-surface/security.json

@@ -121,7 +121,7 @@
     "security/PermissionSet:fields",
     "security/PermissionSet:isDefault",
     "security/PermissionSet:label",
-    "security/PermissionSet:managedBy",
+    "security/PermissionSet:managedBy [RETIRED]",
     "security/PermissionSet:name",
     "security/PermissionSet:objects",
     "security/PermissionSet:packageId",