docs(cli): state the per-package dedup bound the CLI actually holds in #18677 / #18778's pending changesets

Both entries asserted "exactly the set the union could not see" and attributed
it to source text that now explicitly forbids restating it
(packages/cli/src/commands/compile.ts:457-470 and
packages/cli/src/utils/artifact-packages.ts:236-246). A changeset body ships
verbatim into packages/cli/CHANGELOG.md, and both entries are still pending, so
the correction costs a diff today and a published falsehood after the next
release.

Each now states the settled bound in the source's own words -- the per-package
findings no union finding already carried under the same rule, `where`, message
and non-top-level position -- together with the narrowness caveat those
docblocks give for it: two entries rendering the same `where` still collapse.

Prose only; no code path changes.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QCdUBjM47SxioST9z5Zwdf

Author: claude

.changeset/18677-validate-per-package-authoring-pass.md

@@ -4,7 +4,7 @@
 
 `os validate` runs the per-package author-time rule pass `os build` already ran — the false-clean residue #17069 left one layer down.
 
-`os build` runs the artifact's authoring rules **twice**: once over the union-folded stack, then a second `runAuthoringRules('build', …)` pass over each `artifactPackages(…)` entry with `packageBodyAsStack(…)` as resolution context, de-duplicated against the union run. `os validate` ran the union pass and stopped — it imported neither seam. By `compile.ts`' own description the survivors of that second pass are "exactly the set the union could not see", so that whole set was findings `os build` reported and `os validate` **structurally could not**. The direction is false-clean, and on the worse door: the fast pre-flight is what an author runs *before* shipping, so its clean bill of health is the strongest false assurance the three commands can give.
+`os build` runs the artifact's authoring rules **twice**: once over the union-folded stack, then a second `runAuthoringRules('build', …)` pass over each `artifactPackages(…)` entry with `packageBodyAsStack(…)` as resolution context, de-duplicated against the union run. `os validate` ran the union pass and stopped — it imported neither seam. By `compile.ts`' own description the survivors of that second pass are the per-package findings no union finding already carried under the same rule, `where`, message and non-top-level position — deliberately narrower than everything the union run missed, because two entries rendering the same `where` still collapse. That whole set was findings `os build` reported and `os validate` **structurally could not**. The direction is false-clean, and on the worse door: the fast pre-flight is what an author runs *before* shipping, so its clean bill of health is the strongest false assurance the three commands can give.
 
 Measured on `origin/main` 09e16a574 over `examples/app-multi-package`, both commands exiting 0:
 

.changeset/18778-lint-per-package-authoring-pass.md

@@ -8,9 +8,12 @@
 `packages[]` entry with that package's body as the stack and the artifact's own
 `packages[]` as resolution context, since #16611; `os validate` joined it in
 #18677. `os lint` ran the union fold and stopped, so every finding that pass
-produces — "exactly the set the union could not see", in the build command's own
-words — was reported by the command that ships and invisible on the fastest of
-the three doors. All three now call the one shared pass.
+produces — in the build command's own words, the per-package findings no union
+finding already carried under the same rule, `where`, message and non-top-level
+position — was reported by the command that ships and invisible on the fastest
+of the three doors. That bound is deliberately narrower than everything the
+union run missed: two entries rendering the same `where` still collapse. All
+three now call the one shared pass.
 
 Measured on a two-package project whose union run is clean and whose per-package
 run is not (one package owns an object, a sibling package owns the view that