docs(pm-dispatch): advisory_report needs the same advisory write grant as advisory_create (#29619)

<!-- claude-projects-attribution: {"github_login":"huangyiirene"} -->
_Requested by **Irene** · [project
thread](https://claude.ai/code/project/chan_01TJXtQ1tVD26ecLDZxFS67x?thread=cmsg_01TJXtQ1tVD26ecLDZxFS67xU1C787MQBQdgHEzN2hGGe1)_

Part of #29448

## What changes

Two text drifts from the card, items 1 and 2. Item 3 (the workflow
comment) is a separate Tier H PR so this diff stays out of Tier H.

- `.claude/skills/pm-dispatch/references/security-findings.md` §3: the
`advisory_report` bullet said the row is for a repository where the App
has no advisory write grant. It now says `advisory_report` and
`advisory_create` mint the same advisory write grant, so a repository
without it refuses both, and that a report also has a per-account daily
limit. The fallback stays the existing "both refused ⇒ session hand-off"
bullet two lines below. Reworded in place on one line; the file stays at
56 lines (ceiling 56) and the line is 117 bytes (budget 120).
- `scripts/pm/fleet-write/execute.mjs`, the header of "The four advisory
rows": it pointed at `ops.mjs`'s section by its old name, "The three
rows that touch a security advisory". It now names the current "The four
rows that touch a security advisory", and `ops.mjs`'s separate "The one
row that READS an advisory" for the `advisory_read` subsection below it.
Comment only.

## Why

The code mints `repository-advisories: write` for `advisory_report`
exactly as for `advisory_create` (`OPS.advisory_report.permission` is
`repository-advisories` with no `grant`, pinned by `validate.mjs
--self-test`), so the old bullet sent a seat to a row that dies at the
mint on the very repositories it was "kept for". The `execute.mjs`
cross-reference named a section heading that no longer exists in
`ops.mjs`.

## Verification

- `pnpm check:pm-skill-ratchet` exit 0 (security-findings.md 56/56, no
line over the byte budget), `pnpm check:pm-skill-id-lint` exit 0, `node
scripts/check-skills-token-ratchet.mjs` exit 0.
- `node scripts/pm/dispatch-gates.mjs --commands` derived 42 commands
for this diff; all 42 exit 0 on this head, including
`check:pm-fleet-write-execute`, `check:pm-fleet-write-validate`,
`check:pm-fleet-write-dispatch`, `check:scripts-symbol-anchors`,
`check:skill-frame-sync`, `check-comment-mask-corpus` and
`check:doc-formula-expressions` (after building `@objectstack/formula`
and `@objectstack/lint`).
- `node scripts/check-commit-card-trailers.mjs --range
origin/main..HEAD` exit 0.

Clause-②: no
Metadata-protocol: none

_Keep one value on each of the two lines above, each line starting with
its key.
[Human
Minimum](https://github.com/objectstack-ai/objectstack/blob/main/CONTRIBUTING.md#human-minimum)
item 5 says what they mean._

## Human Minimum

- [x] 1. Schemas start as Zod; `packages/spec` holds no runtime logic.
(not touched)
- [x] 2. Every name I added uses the casing for its kind. (no names
added)
- [ ] 3. No formatter ran; `pnpm lint` passes. (no formatter ran; `pnpm
lint` itself was not run locally, the diff touches no linted package
source)
- [x] 4. One issue, one branch off an up-to-date `main`, one pull
request. (the card is split in two PRs by the seat's order, both off
`main`, neither stacked)
- [x] 5. A change that publishes carries a changeset, and both
declaration lines are filled in here and in the changeset. (publishes
nothing: `skip-changeset`)
- [x] 6. `packages/spec` touched: its generated artifacts are
regenerated and committed. (not touched)
- [x] 7. No hand edits to `content/docs/references/`,
`packages/*/CHANGELOG.md` or `content/docs/releases/`.
- [x] 8. Title, body and comments are in English. (the skill file's own
text is Chinese, as the file already is)
- [x] The *Before Submitting* list in CONTRIBUTING.md is done.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01J8VVAjYkaBE16yPTYraBmt

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.claude/skills/pm-dispatch/references/security-findings.md

@@ -20,7 +20,7 @@
 - 私卡 = 受影响仓上一份未发布的安全公告,只有管理员、安全经理与受邀协作者可见。
 - 首选中继 `advisory_create` 建草稿公告,再 `advisory_collaborators_add` 带具名账号进公告。
 - 读公告只走中继 `advisory_read`(席位账号读被拒):一次性密钥只在席位进程,只回密文。
-- `advisory_report` 只留给 App 无公告写权的仓:GitHub 按账号限每日新私报,全队共一个 App。
+- `advisory_report` 与 `advisory_create` 同铸公告写权,无此权的仓两者皆拒;私报另有账号日限。
 - ⛔ 席位永不以自身账号私报或写公告:GitHub 写只走中继,以 App 身份;发布归维护者。
 - 两操作皆被拒 ⇒ 会话专递(选 A):机制只在会话里交维护者,由其建草稿,⛔ 不换账号重发。
 - 私有仓无私密漏洞报告功能,那些操作上线后仍会话专递。

scripts/pm/fleet-write/execute.mjs

@@ -192,8 +192,9 @@
  *
  * ## The four advisory rows — fenced on the ADVISORY, printing none of its text
  *
- * `ops.mjs`'s header section "The three rows that touch a security advisory"
- * is the authority; this is where its fences and landings are measured.
+ * `ops.mjs`'s header section "The four rows that touch a security advisory"
+ * is the authority, and its "The one row that READS an advisory" for the read
+ * below; this is where their fences and landings are measured.
  *
  *   - `advisory_report` is ONE POST of the row's body to the private-report
  *     endpoint, and nothing is read first. It LANDS on a 2xx whose answer