docs(permissions): re-derive the system-context census on the merged tree

The merge of #16755 is the case the census gate exists to catch and the merge
driver cannot: both sides had independently bumped the SAME declared counts
from 106 to 107, so every one of them text-merged cleanly to 107 while the
merged tree now holds 108 elevation reads — main's new
`#refuseUngrantedRunLifecycleWrite` plus this branch's `canReadObject`. Two
correct edits, one wrong sum, and no conflict marker anywhere near it.

Re-derived from the merged tree, after the merge was committed and never
during MERGE state. Seven declared counts move by one; the gate names each and
states there is no mechanical repair, so each was corrected by hand:

  check-system-context-census: OK — 108 elevation read sites in 20 packages
  across 45 files, living in 91 symbol(s); the page cites 105 symbol(s)
  against 105 required, over 129 anchors and 8 file-level citation(s)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

Author: claude

content/docs/permissions/system-context.mdx

@@ -9,7 +9,7 @@ the seed loader replaying package fixtures, a plugin's boot reconciler, a
 service self-write, a migration.
 
 This page is **the authority** for what that flag actually does. It exists
-because the flag is not one concept: it is a single boolean read at **107
+because the flag is not one concept: it is a single boolean read at **108
 distinct sites across 20 packages**, and knowing three of those behaviours gives
 no hint that the other hundred-and-four exist. Every documented app-side bug
 traced to `isSystem` had the same shape — the metadata was complete and correct,
@@ -132,7 +132,7 @@ that silently does not happen.
 
 ### 3. Sharing (`plugin-sharing`)
 
-The largest single consumer — **17 of the 107 sites**.
+The largest single consumer — **17 of the 108 sites**.
 
 | # | Behaviour when `isSystem` | What you get / what you lose | Anchor |
 |:--|:---|:---|:---|
@@ -278,7 +278,7 @@ Ownership injection, `readonly` bypass and sharing materialisation are
 independent decisions, and a seed loader plausibly wants the first two but not
 the third. The concept is nevertheless **staying as one boolean**:
 
-- **Shipped semantics.** `isSystem` is a published contract with 107 read sites
+- **Shipped semantics.** `isSystem` is a published contract with 108 read sites
   in 20 packages. Splitting it is a breaking contract change across all of them.
   (The ruling was taken when the census read 80 sites in 18 packages; the count
   has grown, which strengthens rather than weakens the argument.)
@@ -335,16 +335,16 @@ still holds equal to the census on every pull request:
 | Appearances of the bare identifier `isSystem` in non-test sources | 813 | — |
 | — parsed as a declaration | 22 | ✅ |
 | — parsed as an object-literal / type key (producers and option objects) | 310 | — |
-| — parsed as a property **read** | 113 | ✅ |
+| — parsed as a property **read** | 114 | ✅ |
 | — parsed in some other syntactic position (a local, a cast, a conditional) | 9 | ✅ |
 | — the remainder: text inside comments and string literals | 358 | — |
 | Of those reads: reads of one of the unrelated metadata fields | 6 | ✅ |
-| Of those reads: reads of `ExecutionContext.isSystem` | **107** | ✅ |
-| — behaviour-bearing (rows 1–63 above) | 103 | ✅ |
+| Of those reads: reads of `ExecutionContext.isSystem` | **108** | ✅ |
+| — behaviour-bearing (rows 1–63 above) | 104 | ✅ |
 | — carry the flag onward only (rows 64–67 above) | 4 | ✅ |
 | Packages containing at least one elevation read | **20** | ✅ |
 | Files containing at least one elevation read | 45 | ✅ |
-| — the distinct symbols those reads live in — what this page anchors | 90 | ✅ |
+| — the distinct symbols those reads live in — what this page anchors | 91 | ✅ |
 | — of those files, the ones holding more than one read in one symbol | 9 | ✅ |
 
 The six rows marked — are a **dated decomposition, not a live claim**: they were