fix(spec): restore step18's two hand-edited lines the merge resolution dropped

`migrations/registry.ts` is generated only BETWEEN its `os-generated`
markers; `step18.conversionIds` and `step18.rationale` are hand-authored
append regions outside them. Resolving the merge conflict by taking
main's side and regenerating therefore restored every entries-derived
row and silently dropped both of this branch's hand-edits, which no
generator reproduces.

The consequence was not cosmetic: without
`'page-assigned-profiles-removed'` in `step18.conversionIds` the 17 -> 18
hop stops applying the conversion at all, so a replayed page keeps
`assignedProfiles`. `migrations.test.ts`'s chain-replay composability
gate caught it — "expected { pages: [ {...3}, {...3} ] } to deeply equal
{ pages: [ {...2}, {...3} ] }", the key still present after the chain.
That gate is the reason a clean merge is not a working merge.

Both intents are kept, main's first: the conversion id list carries
`list-view-sort-string-clause-to-array` then
`page-assigned-profiles-removed`, and the rationale carries main's
list-view sort paragraph then this branch's `page.assignedProfiles` one.
Re-running `gen:migration-registry` afterwards is byte-identical, which
is the proof these lines sit outside the generated regions.

Claude-Session: https://claude.ai/code/session_01EfsizFDgAcEjpwv4oM3WGT
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/spec/src/migrations/registry.ts

@@ -5470,7 +5470,19 @@ const step18: MigrationStep = {
     + 'multi-key form becomes one entry per key in the same order. A string that does not parse as '
     + 'that grammar — the `\'-field\'` dialect above all — is left alone and meets the door instead: '
     + 'that dialect belongs to `RecordRelatedListProps.sort`, never reaches '
-    + '`convertSortToQueryParams`, and retiring it was NOT ruled.',
+    + '`convertSortToQueryParams`, and retiring it was NOT ruled. '
+    + 'It also removes `page.assignedProfiles` (ADR-0090 D2 / ADR-0049 enforce-or-remove; '
+    + 'maintainer ruling 2026-09-12 \u300c\u540c\u610f\u300d). The key was authorable on the published '
+    + '`PageSchema` and named for the Profile concept ADR-0090 D2 deleted, while the schema\'s own '
+    + 'alias table CORRECTED an authored `profiles:` into it — two files from '
+    + '`security/permission.zod.ts` answering the same word with "no Profile concept". Measured '
+    + 'across this repository and objectui it had zero readers, so a page that "assigned '
+    + 'profiles" was open to every caller who could reach it. It is a retiredKey tombstone on '
+    + '`PageSchema` — the def is still parsed from the `page` root, so there is an author to '
+    + 'teach — and the two alias entries became refusals naming the permission-set route. The '
+    + 'D2 conversion STRIPS the key — there is no lossless target, because which permission set '
+    + 'a given profile name corresponds to is a judgement no walker can make, which is what the '
+    + 'paired D3 semantic entry is for.',
   conversionIds: [
     'field-malformed-scale-precision-removed',
     'record-chatter-position-vocabulary',
@@ -5499,6 +5511,7 @@ const step18: MigrationStep = {
     'turso-config-timeout-to-timeout-ms',
     'view-page-mount-removed',
     'list-view-sort-string-clause-to-array',
+    'page-assigned-profiles-removed',
   ],
   semantic: [
     // One file per entry under `entries/semantic/`, concatenated here sorted by