test(plugin-auth): satisfy check:test-source-alias on the positions-axis pin

`check:test-source-alias` is the only step making `Lint & Repo Gates` red on
this PR: job 101340631783 fails at step 130 and skips steps 131-148, so the
merge-driver gate that reds other PRs on this seat never runs here. Base-branch
control: the same gate exits 0 on `origin/main` f7db8f4, and the test file is
absent from that ref, so the redness is this PR's.

Both findings are remedied exactly as the gate's own text dictates.

1. `session-positions-security-axis.test.ts:235` paid
   `import('@objectstack/core')` inside an `it()` body -- a CLOCKED window, and
   `@objectstack/core` is one of the specifiers this package still resolves
   through `dist/`. A module-top side-effect import pays that transform during
   collection, which vitest clocks against nothing. The dynamic call stays
   exactly where it is, and no timeout was widened -- widening relocates the
   cliff to the next heavier shard.

2. `@objectstack/formula` was a NEW unaliased artifact import for this package
   (`celEngine`, the real CEL engine the pins evaluate `current_user.positions`
   with). One anchored entry in the package's `vitest.config.ts` resolves it to
   `packages/formula/src/index.ts`, which exists in the checkout.
   `KNOWN_UNALIASED_TEST_IMPORTS` is shrink-only, so no registry row was added
   or widened; plugin-auth's existing entry is untouched.

Verified: `check:test-source-alias` --self-test and the real run both exit 0,
the real run reporting the same counts as the base-branch control (72 packages
scanned / 61 registered / 49 published subpaths). `pnpm --filter
@objectstack/plugin-auth test` still 102 files / 2142 tests passed, and the
package's full `typecheck` task is green with its test-typecheck ledger
unchanged at 10 file(s) / 94 error(s) / 23 pinned signature(s).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y

Author: claude

packages/plugins/plugin-auth/src/session-positions-security-axis.test.ts

@@ -45,6 +45,16 @@ import { AuthManager } from './auth-manager';
 import { createMemoryEngine } from './impersonation-bearer-rotation.test';
 import { inviteForAudienceGate } from './audience-gate-test-support';
 
+// [#10126] Pay the first transform of this dist-resolved workspace dep at MODULE
+// LOAD. `@objectstack/core` is reached below only through a dynamic `import()`
+// inside an `it()` body (the `resolveUserAuthzGrants` parity pin), and vitest
+// clocks test bodies and hooks while collection is clocked against nothing. See
+// `scripts/check-test-source-alias.mjs` (the clocked-window rule) and #10115 /
+// PR #10120, where the same shape cost 30 ejected merge-queue builds in one
+// night. The dynamic call stays where it is -- this only decides WHERE the
+// first load is paid.
+import '@objectstack/core';
+
 const SECRET = 'test-secret-at-least-32-chars-long!!';
 const PASSWORD = 'S3cure!Passw0rd-15136';
 const BASE = 'http://localhost:3000/api/v1/auth';

packages/plugins/plugin-auth/vitest.config.ts

@@ -37,6 +37,17 @@ export default defineConfig({
         find: /^@objectstack\/service-messaging$/,
         replacement: path.resolve(here, '../../services/service-messaging/src/index.ts'),
       },
+      // [#15136] `session-positions-security-axis.test.ts` takes a VALUE
+      // import on `@objectstack/formula` (`celEngine`) — the real CEL engine
+      // the server evaluates formulas and RLS with. Same reason and the same
+      // anchoring as the two entries above. `check:test-source-alias` reports
+      // a new artifact import here as a finding and dictates this remedy: its
+      // `KNOWN_UNALIASED_TEST_IMPORTS` registry is ⛔ SHRINK-ONLY, so aliasing
+      // the specifier is the fix and a new registry row is not.
+      {
+        find: /^@objectstack\/formula$/,
+        replacement: path.resolve(here, '../../formula/src/index.ts'),
+      },
     ],
   },
 });