fix(runtime): dispatcher 面 /share-links 整体透传 ExecutionContext 给 enforcement (#6551) (#6647)

* fix(runtime): dispatcher /share-links passes the whole ExecutionContext to enforcement (#6551)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uFVNMmTxLpmfQYiuKM1Yx

* changeset: runtime patch — dispatcher share-links full envelope (#6551)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uFVNMmTxLpmfQYiuKM1Yx

* test(runtime): manifest service in SecurityPlugin boot harness (#6551)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uFVNMmTxLpmfQYiuKM1Yx

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-project-manager

.changeset/share-links-dispatcher-full-envelope.md

@@ -0,0 +1,5 @@
+---
+"@objectstack/runtime": patch
+---
+
+Dispatcher-face `/share-links` enforcement now receives the caller's complete resolved `ExecutionContext` (#6551 — the dispatcher half of #6206). The domain handler used to rebuild a two-field `{ userId, tenantId }` subset and hand it to `createLink` / `listLinks` / `revokeLink`, dropping `accessible_org_ids`, `positions`, `permissions`, `org_user_ids`, `systemPermissions`, `posture` and `tabPermissions` on the way into enforcement. Under the `group` tenancy posture the Layer 0 wall reads `accessible_org_ids` and an absent set denies (fail closed), so creating a link answered 403 for records the caller reads fine elsewhere; a record visible only through a position-bound permission set was likewise refused even under the `single` posture. The envelope is now passed through whole per the #6511 contract; the routes' own 401 gate still reads only `userId`.

packages/runtime/package.json

@@ -47,6 +47,7 @@
   "devDependencies": {
     "@objectstack/platform-objects": "workspace:*",
     "@objectstack/plugin-hono-server": "workspace:*",
+    "@objectstack/plugin-sharing": "workspace:*",
     "@objectstack/service-analytics": "workspace:*",
     "@objectstack/service-datasource": "workspace:*",
     "@objectstack/service-job": "workspace:*",