docs(runtime,metadata-protocol): append a correction to the false scope-less clause in the published 17.3.0 CHANGELOG (#16493)

The 17.3.0 CHANGELOG entry for #14375 (`writable` verdict) said a
scope-less `type: module` carried by a multi-package artifact lands as
read-only alongside the marketplace/offline-import case. That is false:
`defineStack` parses every `packages[]` entry through `ManifestSchema`,
whose `scope` is `.default('project')`, so no package of a compiled
artifact is ever scope-less (#14803 already fixed the live source
comment and prose; this corrects the two published CHANGELOG.md files
that still carry the original false sentence).

Per the published-release-text policy: the original sentence stays
verbatim, and a dated, referenced correction is appended next to it in
both packages/runtime/CHANGELOG.md and packages/metadata-protocol/CHANGELOG.md,
under their `## 17.3.0` entries.


Claude-Session: https://claude.ai/code/session_01Vbw3RPgdtqesx4azk9SbW8

Co-authored-by: Claude <noreply@anthropic.com>

Author: baozhoutao

packages/metadata-protocol/CHANGELOG.md

@@ -968,6 +968,9 @@
     row that has no registry presence (durable-only) carries no verdict, and the
     REST detail door's database-first row does not either — the registry item is
     the only carrier, by design.
+  - **Correction (2026-09-07):** no package of a compiled artifact is
+    scope-less — `ManifestSchema` defaults `scope` to `project`; the
+    "scope-less `type: module`" clause above is withdrawn, see #14803 / #16122.
 - 95464ed: fix(metadata-protocol): the three recovery doors run the ADR-0094 mutation projector
 
   `rollbackMetaItem`, both limbs of `revertCommit`, and `deleteMetaItem`'s

packages/runtime/CHANGELOG.md

@@ -1719,6 +1719,9 @@
     row that has no registry presence (durable-only) carries no verdict, and the
     REST detail door's database-first row does not either — the registry item is
     the only carrier, by design.
+  - **Correction (2026-09-07):** no package of a compiled artifact is
+    scope-less — `ManifestSchema` defaults `scope` to `project`; the
+    "scope-less `type: module`" clause above is withdrawn, see #14803 / #16122.
 - 8ce628a: fix(objectql,runtime,rest): store a serializable manifest in the package registry so `/packages` stops answering 500 (#14309)
 
   On a stock showcase boot, signed in as the seeded admin, every read door that