fix(core): PHASE2_IMPLEMENTATION.md imports from the root barrel, not an undeclared subpath (#16205)

`packages/core/PHASE2_IMPLEMENTATION.md` sections 4 and 5 told readers to write
`import { … } from '@objectstack/core/security'`. `packages/core/package.json`
declares exactly two `exports` entries, `.` and `./logger`, with no `./security`
and no wildcard, so that specifier resolves for no consumer of the published
package. Measured live at this head:

  ERR_PACKAGE_PATH_NOT_EXPORTED - Package subpath './security' is not defined
  by "exports" in packages/core/package.json

with `@objectstack/core/logger` resolving on the same command as the control.

Both classes are real and both are exported from the ROOT barrel, reached by
`export * from './security/index.js'` in `packages/core/src/index.ts`. So the
symbols exist and only the path is wrong. Both lines now name `@objectstack/core`.
Verified against the built root entry that the repaired specifier is true:
`PluginPermissionManager` and `PluginSandboxRuntime` are both declared in
`dist/index.d.ts` and both load from `dist/index.cjs`, with the retired
`PluginSecurityScanner` absent as the negative control and `PluginHealthMonitor`
present as the positive one.

No contract change: `packages/core/package.json` is untouched. Adding a
`./security` entry would widen the published surface on no evidence of demand
and remains the maintainer's call.


Claude-Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

packages/core/PHASE2_IMPLEMENTATION.md

@@ -158,7 +158,7 @@ The Permission Manager enforces fine-grained access control for plugins.
 **Usage:**
 
 ```typescript
-import { PluginPermissionManager } from '@objectstack/core/security';
+import { PluginPermissionManager } from '@objectstack/core';
 
 const permManager = new PluginPermissionManager(logger);
 
@@ -216,7 +216,7 @@ The Sandbox Runtime provides isolated execution environments with resource limit
 **Usage:**
 
 ```typescript
-import { PluginSandboxRuntime } from '@objectstack/core/security';
+import { PluginSandboxRuntime } from '@objectstack/core';
 
 const sandbox = new PluginSandboxRuntime(logger);