docs(permissions): regenerate the system-context census after the second main merge (#15302)

Step 4 of `scripts/pm/os-regen-merge.sh` for the merge of `origin/main` in
234b282. `content/docs/permissions/system-context.mdx` is a `merge=os-regen`
path and both sides moved it again: #16029 shortened `share-link-service.ts`,
moving row 37's five anchors, while this branch carries the three provenance
re-anchors. The driver again merged with exit 0 while keeping one side, so
step 2 took main's side back and this commit is
`pnpm gen:system-context-census` re-deriving the page on top of it.

Row 37 now reads `share-link-service.ts:459`, `:513`, `:517`, `:590`, `:620`
(from `:469`, `:523`, `:527`, `:600`, `:630`), and this branch's
`email-template-provenance.ts:77`, `sharing-rule-provenance.ts:66` and
`webhook-provenance.ts:68` are unchanged from the previous regeneration.

`--fix` REFUSED ZERO files. A second `--fix` run rewrites 0 anchors; the gate
and its `--self-test` both exit 0 on the merged tree.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y

Author: claude

content/docs/permissions/system-context.mdx

@@ -135,7 +135,7 @@ The largest single consumer — **17 of the 105 sites**.
 | 34 | `revoke()` deletes directly, **before** the non-manual-source guard | Get: the evaluator can revoke its own grants. Lose: the `CONFLICT` guard that warns a rule-materialised grant will be silently re-granted on the next reconcile | `plugin-sharing/src/sharing-service.ts:1476` (guard at `:1501`) |
 | 35 | `listShares()` skips the management gate | Get: full enumeration of who can see a record | `plugin-sharing/src/sharing-service.ts:1528` |
 | 36 | `sys_record_share` reads are **not** self-scoped | Get: tenant-wide share listing without `manage_sharing` | `sharing-plugin.ts:1189` |
-| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:469`, `:523`, `:527`, `:600`, `:630` |
+| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:459`, `:513`, `:517`, `:590`, `:620` |
 | 38 | Sharing-rule provenance stamp skipped | Lose: the row is not marked as an admin customization — seeder / `defineRule` / boot reconcilers are "the package door" | `sharing-rule-provenance.ts:66` |
 | 39 | Sharing-rule service write + delete paths return early | Lose: the manage-rules gate on the service surface, and the platform-global-rule delete guard | `sharing-rule-service.ts:278`, `:503` |