docs(permissions): re-anchor row 37's five citations after the -10 line shift

`check-system-context-census` red on `1f294f94a`: this PR's edit to
`plugin-sharing/src/share-link-service.ts` is +10 above line 45 and -20 above
line 108, so every line below shifts by exactly -10, and row 37 of
`content/docs/permissions/system-context.mdx` cites five of them by number.

All five are PURE LINE ROT, checked per anchor with the file open rather than
assumed: the text now at 459 / 513 / 517 / 590 / 620 is byte-identical to the
text that was at 469 / 523 / 527 / 600 / 630 at the merge base, and the diff's
two hunks both end above line 108 — no line at or below the first anchor was
touched at all. Row 37's claim ("share-link policy `enabled` check bypassed;
system callers re-enter under a system context") is unchanged and still
described by the same five `context.isSystem` reads, so no ledger row with a
needle is owed here.

Repaired with `node scripts/check-system-context-census.mjs --fix`, which
rewrote exactly those five numbers and no prose.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ

Author: zhuangjianguo

content/docs/permissions/system-context.mdx

@@ -135,7 +135,7 @@ The largest single consumer — **17 of the 105 sites**.
 | 34 | `revoke()` deletes directly, **before** the non-manual-source guard | Get: the evaluator can revoke its own grants. Lose: the `CONFLICT` guard that warns a rule-materialised grant will be silently re-granted on the next reconcile | `plugin-sharing/src/sharing-service.ts:1476` (guard at `:1501`) |
 | 35 | `listShares()` skips the management gate | Get: full enumeration of who can see a record | `plugin-sharing/src/sharing-service.ts:1528` |
 | 36 | `sys_record_share` reads are **not** self-scoped | Get: tenant-wide share listing without `manage_sharing` | `sharing-plugin.ts:1088` |
-| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:469`, `:523`, `:527`, `:600`, `:630` |
+| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:459`, `:513`, `:517`, `:590`, `:620` |
 | 38 | Sharing-rule provenance stamp skipped | Lose: the row is not marked as an admin customization — seeder / `defineRule` / boot reconcilers are "the package door" | `sharing-rule-provenance.ts:47` |
 | 39 | Sharing-rule service write + delete paths return early | Lose: the manage-rules gate on the service surface, and the platform-global-rule delete guard | `sharing-rule-service.ts:202`, `:427` |