docs(permissions): re-anchor the system-context census to the two shifted elevation reads

`check:check-system-context-census` failed with pure line rot: the per-grant
catch added 37 lines above `sharing-rule-service.ts`'s two `context?.isSystem`
elevation reads, so the census page's anchors pointed at :157/:382 while the
reads now sit at :194/:419. Re-anchored with the gate's own `--fix`; no prose
and no behaviour changed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Author: claude

content/docs/permissions/system-context.mdx

@@ -137,7 +137,7 @@ The largest single consumer — **20 of the 109 sites**.
 | 36 | `sys_record_share` reads are **not** self-scoped | Get: tenant-wide share listing without `manage_sharing` | `sharing-plugin.ts:1077` |
 | 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link creation/resolution while the policy is off | `plugin-sharing/src/share-link-service.ts:449`, `:503`, `:507`, `:580`, `:610` |
 | 38 | Sharing-rule provenance stamp skipped | Lose: the row is not marked as an admin customization — seeder / `defineRule` / boot reconcilers are "the package door" | `sharing-rule-provenance.ts:47` |
-| 39 | Sharing-rule service write + delete paths return early | Lose: the manage-rules gate on the service surface, and the platform-global-rule delete guard | `sharing-rule-service.ts:157`, `:382` |
+| 39 | Sharing-rule service write + delete paths return early | Lose: the manage-rules gate on the service surface, and the platform-global-rule delete guard | `sharing-rule-service.ts:194`, `:419` |
 
 ### 4. Approvals, reports, attachments, comments, knowledge