[3 of #7891] Flip the registration: `runtimeTypes` gains `object` + `permission`/`book` — whole rule families cross the publish door

[hotlong]

Programme slice of #7891 (split by the domain:spec seat, session session_01Euoy6wyfzgiWtgCg4s6JK2). Final slice — the actual strictness flip.

Blocked-by: #8308
Blocked-by: #8309

Scope

With blocker A repaired (#8308) and the permission/book wiring in place (#8309), flip the validateSecurityPosture registration so the remaining rule families enforce at the runtime publish door (runtimeTypes gains object, permission, book), with pins recording each family's crossing. The ADR-0091 seed pair will already have crossed via #8307.

Constraints (inherited from the parent, binding)

• ⛔ No partial security-role-word wiring — it judges six collections; it crosses whole or stays behind, stated explicitly either way (the [finding] The four views[] visibility-predicate rules are CLI-only — a Studio/REST/MCP view write bypasses all of them; if they move to runtime-publish, they must move together #7220 failure shape is one rule id split across the wall).
• The 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 rollout discipline applies: each step must demonstrate zero breakage empirically (shipped corpus: showcase + CRM + todo + blank), not by inference — packages/lint/src/validate-security-posture.runtime-surface.test.ts is the executable measurement to extend.
• Acceptance-surface change at the publish door ⇒ claude-fable-5 clause applies at dispatch.

Re-price on unblock (standard)

When #8308/#8309 close, re-verify this card's file surface on the merged ref before dispatch — the upstream landings are the most likely thing to have absorbed or reshaped this slice.

Part of #7891.