docs(rest): state the direction the read predicate rules on at the /published door

The `GET /meta/:type/:name/published` handler's comment argued that passing
the RAW tenant "is right for a READ" because `getMetaItemLayered`'s overlay
lookup is org-scoped-first then env-wide, so "nothing that resolves today
stops resolving". That fail-open direction is precisely the reasoning
`organizationIdForMetaRead` was written to refute: an org named on a type the
registry does not declare per-org overridable resurrects the phantom rows
#6190 stopped minting.

Since #14907 the callee gates: `getMetaItemLayered` resolves
`organizationIdForMetaRead` itself, AFTER its canonical fold. So the raw
tenant is correct here for a different reason than the one stated, and this
door must NOT pre-gate — `req.params.type` is unfolded, and gating on it is
the #10340 defect.

Because the old prose read as a deliberate, reasoned decision to gate, two
successive enumerations in the same series recorded this door as already
gating when it does not. The `#8805` half above is untouched and still true.

Comment-only and line-count-neutral: 8 comment lines out, 8 in, no
executable change, so the absolute-line anchors in
`content/docs/permissions/system-context.mdx` cannot move.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YFY46JydE1gMxQG1TqBcMZ

Author: claude

packages/rest/src/rest-server.ts

@@ -8205,14 +8205,14 @@ export class RestServer {
                         // inventing org RESOLUTION here, and this reads
                         // `tenantId` off the execution context `resolveExecCtx`
                         // already resolves, exactly as #8803 did for the audit
-                        // read. The raw tenant is right for a READ (the write
-                        // doors run it through `organizationIdForMetaWrite`
-                        // instead): `getMetaItemLayered`'s overlay layer is
-                        // org-scoped-first, THEN env-wide, so this is fail-open
-                        // in the safe direction — an org-less caller reads
-                        // exactly what it reads today, and an org-scoped caller
-                        // still falls back to the env-wide row. Nothing that
-                        // resolves today stops resolving.
+                        // read. [#14907] The CALLEE gates: `getMetaItemLayered`
+                        // resolves `organizationIdForMetaRead` AFTER its canonical
+                        // fold, so the tenant goes over RAW. ⛔ Pre-gating HERE, on
+                        // the unfolded `:type`, would be the #10340 defect. ⛔ And
+                        // the old "fail-open in the safe direction" reading is the
+                        // argument the predicate refutes: an org named on a type
+                        // the registry does not declare overridable resurrects the
+                        // phantoms #6190 stopped minting.
                         //
                         // Environment scoping still holds: it comes from WHICH
                         // protocol `resolveProtocol` hands back, not from the