fix(model): harden model-layer SHOULDs M2–M8

[bpamiri]

Summary

Model-layer Hardener SHOULDs M2–M8. Red proofs and green locks live in vendor/wheels/tests/specs/model/hardener/.

M6 is default-inner + opt-in outer. belongsTo include still defaults to joinType="inner" (orphans are dropped). Pass joinType="outer" on the association to keep parent rows with no associated record. This PR does not change the belongsTo default to outer.

Does not close #3378 or basecoat #15. Does not close unrelated issues. Do not merge. Keep draft.

Type of Change

• Bug fix
• Enhancement to existing feature
• Documentation update

Feature Completeness Checklist

• DCO sign-off -- Every commit carries Signed-off-by:
• Tests -- vendor/wheels/tests/specs/model/hardener/ModelHardenerM2M8Spec.cfc plus existing-spec pin updates in validationsSpec, crudSpec, queryBuilderSpec
• Framework Docs -- web/sites/guides/src/content/docs/v4-0-0/basics/query-builder-and-scopes.mdx, upgrading/whats-new-in-4.mdx; API belongsto.md (default inner), validatesuniquenessof.md; vendor/wheels/public/docs/reference/model/{belongsto,validatesuniquenessof,accessibleproperties,protectedproperties}.txt
• AI Reference Docs -- CLAUDE.md query-builder line names the 1-arg raw-SQL exception
• CLAUDE.md -- updated for the query-builder contract
• Changelog fragment -- changelog.d/model-hardener-m2-m8.{added,changed,fixed}.md (no "belongsTo now defaults to outer" claim)
• Test runner -- filters below on HEAD 596f22e3c. Full LuCLI still needs CI confirmation on this HEAD.

Test Plan

wheels test --core --ci --filter=model.hardener
wheels test --core --ci --filter=model

(directory= must point at a folder; a single-file scope discovers 0 bundles.)

1. Red (add1daaa4 prove-red only): 4 passed, 7 failed, 1 error(s).
2. Green (acfdf85ca fix commit): 12 passed.
3. HOLD rewrite (596f22e3c): restore default-inner + opt-in outer; afterFind on returnAs=struct rows.

Local on 596f22e3c:

• wheels test --core --ci --filter=model.hardener → 14 passed (0.04s)
• wheels test --core --ci --filter=model → 983 passed (2.14s) (includes callbacks returnAs=struct / VIEWS path and restored JOINs should be grouped #449/SQL Generation Bug: Variable state leakage in findAll(include="...") when mixed nested and shallow joins are used #3334 SQL pins)

PROVEN / UNPROVEN

ID	Claim	Status	Filter / evidence
M2	validatesUniquenessOf default includeSoftDeletes=false so a soft-deleted value can be reused	PROVEN	wheels test --core --ci --filter=model.hardener — 14 passed
M3	QueryBuilder 1-arg where() is raw SQL; class/docs no longer claim universal injection-safety	PROVEN	same filter
M4	create() does not mass-assign onto the shared class model (setOnModel=false)	PROVEN	same filter
M5	Nested hasMany keys use new- / _new / blank PK, not a GetTickCount window	PROVEN	same filter
M6	Default belongsTo include is inner (orphans dropped). Opt-in joinType=outer keeps orphans.	PROVEN default-inner + opt-in outer. Do not claim outer default.	same filter + restored #449/#3334 crudSpec SQL pins in filter=model
M7	hasChanged treats StructDelete of a persisted property as a change; findAll(returnAs="struct") afterFind no longer reads columns off the class	PROVEN	hardener + filter=model (983 passed; VIEWS path in serialize.cfc)
M8	Fail-closed mass assignment by default	UNPROVEN / DEFERRED. Opt-in only: set(massAssignmentStrict=true). Default stays open.	same filter

HEAD: 596f22e3c0d7e42ff29d510e6a6826fe0aa9ddec