docs(permissions): re-anchor the system-context census citation after the guard header grew

The last-admin-guard header rewrite in this branch added 13 net lines above the
`applies to EVERY context, isSystem included` line, moving it from 286 to 299.
`check-system-context-census` anchors that line from
`content/docs/permissions/system-context.mdx`, and its NON_READ_ANCHORS row
finds it by NEEDLE rather than by number — so the ledger row followed the code
and the page's hard-coded number did not, reddening the gate in both
directions at once (anchor-is-not-a-read-site + ledger-row-unused).

Repaired by the gate's own `--fix`, which is the authority on the form:
  re-anchored .../system-context.mdx:201  `last-admin-guard.ts:286` -> `:299`

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Author: claude

content/docs/permissions/system-context.mdx

@@ -198,7 +198,7 @@ assuming `isSystem` covers it is a documented source of bugs.
 | "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10007`–`10024` |
 | "It preserves a supplied `updated_at` / `updated_by`" | **No.** That is `preserveAudit`, a separate opt-in — and an UPDATE-path exemption only | `field.zod.ts:1516` (#3493 / #6640) |
 | "It stamps `created_by`" | **No.** Audit stamping reads `userId` from the context. A user-less system write stamps nothing — that is today's behaviour, not an error | `runtime-identity.ts:280`–`281` |
-| "It bypasses every guard" | **No.** The last-admin guard applies to **every** context, `isSystem` included — the deprovision path that actually locks an org out is the system one | `last-admin-guard.ts:286` |
+| "It bypasses every guard" | **No.** The last-admin guard applies to **every** context, `isSystem` included — the deprovision path that actually locks an org out is the system one | `last-admin-guard.ts:299` |
 | "A client can request it" | **No.** Never settable from inbound HTTP or from an action body | `rest-server.ts:1522`, `:1551`; `domains/actions.ts:404` |
 
 ---