skills(objectstack-data security): renaming a position — tell the author to re-point their own package source, and name the environment owner #33566

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Filing gate: ① (follow-ups from the at-tier contract review 6886676047 of merged PR #33480, card #33044).

The "Renaming a position" paragraph in skills/objectstack-data/rules/security.md (merged as 8e63ed87) holds, with three gaps worth a sentence:

1. It does not tell the author to re-point their own package source that names the old position (a sharing-rule recipient, an approval position:NAME slot, RLS over positions). "The boot log lists other references for an admin" can read as nothing else to do.
2. "Recorded under another package" omits the environment as owner (the sys_metadata sentinel).
3. The card's premise said Setup-authored bodies are read by the holder carry; they are not. Say so, or confirm it against position-renamed-holder-carry.ts and record the reading.

Also restore, somewhere in skills/**, the operator rule cut by the PR: the explain endpoint needs manage_users. @objectstack/skills patch. Token ratchet paid in place.