docs(permissions): re-anchor the system-context census row this diff shifted

`content/docs/permissions/system-context.mdx` anchors source files by
ABSOLUTE LINE NUMBER, so adding `requireDuplicableSource` to
`packages/runtime/src/domains/packages.ts` rotted row 52's citation of
the anonymous-deny seam: `domains/packages.ts:422` -> `:535`, a shift of
exactly the 113 lines inserted above it.

Repaired with `node scripts/check-system-context-census.mjs --fix` (1
anchor rewritten); no line number was hand-edited.

Verified as a PURE SHIFT rather than a population change, by re-deriving
`node scripts/isystem-census.mjs --json` on BOTH sides (origin/main
4f37912 and this branch) in the same session rather than reusing any
earlier figure: sites 106 = 106, identifierAppearances 885 = 885,
classified 462 = 462, scannedFiles 293 = 293 (non-zero control),
nonElevationReads 6 = 6, staleLedgerRows 0 = 0, and every roleCounts /
text member equal. Keyed on identity (file, package, receiver, text) and
compared as a MULTISET so duplicate keys inside one file cannot collapse:
89 distinct keys carrying 106 sites on both sides, ARRIVED = 0,
VANISHED = 0, and exactly one site's LINE moved — in the one file this
branch edits, with zero line moves anywhere else.

Row 55's sibling anchor `domains/packages.ts:241` is deliberately
untouched: it sits above the first edit, so it did not shift. Swept the
whole of `content/` and `docs/` for other anchors into the four files
this branch resizes — those two are the only hits, against a control of
559 anchor-shaped citations tree-wide.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N

Author: claude

content/docs/permissions/system-context.mdx

@@ -160,7 +160,7 @@ The largest single consumer — **17 of the 106 sites**.
 | 49 | Action `requiredPermissions` bypassed | runtime | Get: engine self-invocation runs any action | `action-execution.ts:401` |
 | 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:5084`, `:6510`, `:6758`, `:7189`, `:7382` |
 | 51 | The shared metadata-write verdict itself returns `allowed` | metadata-core | Get: the one function all of row 50's doors consult answers yes before any capability is examined | `meta-write-capability.ts:134` |
-| 52 | Anonymous-deny seam satisfied on the domain dispatchers and the package/federation routes | runtime, rest | Get: passes with no `userId` | `domains/actions.ts:421`, `domains/ai.ts:60`, `domains/automation.ts:989`, `domains/meta.ts:232`, `domains/security.ts:78`, `domains/packages.ts:422`, `external-datasource-routes.ts:302`, `package-routes.ts:97` |
+| 52 | Anonymous-deny seam satisfied on the domain dispatchers and the package/federation routes | runtime, rest | Get: passes with no `userId` | `domains/actions.ts:421`, `domains/ai.ts:60`, `domains/automation.ts:989`, `domains/meta.ts:232`, `domains/security.ts:78`, `domains/packages.ts:535`, `external-datasource-routes.ts:302`, `package-routes.ts:97` |
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |
 | 54 | Package REST route capability gate bypassed | rest | Get: package read/write over REST without `manage_metadata` / `studio.access` / `setup.access` | `package-routes.ts:102` |
 | 55 | Package domain capability gates bypassed | runtime | Get: package management and package-inventory reads without the capability | `domains/packages.ts:241`, `:274` |