docs: name the canonical docs host in the governed protection examples (#11194)

The maintainer ruled on 2026-08-21 that this repo's canonical docs-site URL
is https://objectstack.ai. Four `protection.docsUrl` occurrences on governed
surfaces still carried the `docs.objectstack.ai` spelling.

All four are the same literal, and the host was only half the defect: the
`/adr/0010-metadata-protection` path is not a route on any host (the docs
site mounts `content/docs` under `/docs`, and `docs/adr/` is not published).
They now match the literal that landed in source: the published reference
for the very schema that carries the field.

- skills/objectstack-data/SKILL.md (3) — the propagating surface; the
  published skill teaches AI authors what to write into a `protection`
  block, so a dead URL travels outward into codebases this repo cannot see.
- docs/adr/0010-metadata-protection-model.md (1) — a verbatim quotation of
  the `packages/spec/src/shared/protection.zod.ts` example; the docsUrl line
  was the block's only divergence from the source it quotes.

docs/adr/0046-package-docs-as-metadata.md:85 is deliberately left alone: it
names the host in a Non-goals bullet recording a scope boundary, not as a
link. Prime Directive #13 — an accepted ADR is not silently reworded.

Byte-neutral: both literals are 56 bytes, so SKILL.md stays at 55265 bytes
and the skills token ratchet stays at 13817/13817.

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

docs/adr/0010-metadata-protection-model.md

@@ -562,7 +562,7 @@ export const SETUP_APP: App = {
   protection: {
     lock: 'full',
     reason: 'Core admin UI shipped by @objectstack/platform-objects.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   // ...
 };

skills/objectstack-data/SKILL.md

@@ -895,7 +895,7 @@ export const SysUserObject = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Core identity object — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   fields: { /* ... */ },
 });
@@ -913,7 +913,7 @@ export const SysRoleObject = ObjectSchema.create({
   protection: {
     lock: 'no-overlay',
     reason: 'RBAC schema is platform-defined — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   fields: { /* ... */ },
 });
@@ -934,7 +934,7 @@ export const SetupApp = defineApp({
   protection: {
     lock: 'full',
     reason: 'Core admin UI shipped by @objectstack/platform-objects — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   // ...
 });