test(rest): drive the tenancy axis of GET /ui/view/:object/:type — an anonymous caller can name another environment and receive its UI view (#13258)

* test(rest): drive the tenancy axis of GET /ui/view/:object/:type

Extends PR #13244's measurement with the axis it explicitly did not assert:
its harness had no envRegistry and no kernelManager, so the environment
resolution chain was read from source and never driven.

Measurement only. rest-server.ts is untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TvqBFLRzXdSPcbusDoED9k

* test(rest): pin the blast-radius readings to the crossed environment's body

The ablation showed three §3 assertions were envelope-shape readings true of
either environment, so they survived a leg that removed the crossing. Each now
asserts environment B's own label first, making the inventory a statement about
what the NAMED environment disclosed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TvqBFLRzXdSPcbusDoED9k

* test(rest): measure the environment-id oracle the unvalidated fallback creates

An unknown X-Environment-Id does not refuse; it falls through to the default
environment and answers 200 with that environment's view. Two 200s with
different bytes let an anonymous caller distinguish a real environment id from
an invented one, which is the difference between "must possess an id" and
"can discover one".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TvqBFLRzXdSPcbusDoED9k

* test(rest): re-measure §3's `hidden` reading on the crossed path

The case asserted that `hidden` is NOT a uniform floor on the crossed path:
`beta_secret` (hidden, non-priority) was dropped from the list body while
`status` (hidden, priority-named) was served, carrying its authored label.

That reading was true when taken on 2026-08-29 and has since been made false
by a repair, not by an error in the measurement. `2a75270b1e` (#13329, merged
2026-08-30) put `!fields[k].hidden` on getUiView's list priority pass, where it
had sat on the fill pass alone, so the list branch now agrees with the form
branch it had disagreed with.

Re-driven on the repaired producer through the same crossed path — anonymous
request, `X-Environment-Id: env_beta`, unscoped mount, built `dist/` — both
hidden field kinds are now withheld, together with their labels and their
`searchableFields` entries:

    columns    = ["name", "created_at", "beta_only_field"]
    colLabels  = ["Beta Account Name", "created_at", "Beta Only"]
    searchable = ["name", "created_at", "beta_only_field"]
    formFields = ["name", "beta_only_field"]

The case is rewritten to pin that, keeps controls so an empty producer cannot
satisfy it vacuously, and records the 2026-08-29 -> 2026-08-30 sequence in
place so a reader does not conclude the original measurement was wrong. It is
kept rather than deleted because #13329's own pin calls `getUiView` directly
in-package from source; this one is the blast-radius reading for the CROSSED,
cross-environment path through the REST seam and the built artifact.

`rest-server.ts` remains byte-identical to base; no production code changes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TvqBFLRzXdSPcbusDoED9k

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-trump