docs(core,rest): name cloud's mounted variant "licence-gated", not "cloud-private"

Five measurement narratives in packages/core/src/security and
packages/rest/src said the reproduction ran with "the real cloud-private
`@objectstack/organizations`" (or "`Organizations` plugin"). Under
ADR-0132 D3 "one name, two packages" that adjective is ambiguous, not
simply false: it is true of the licence-gated subclass cloud's own app
mounts, and false of the package name, which resolves in this workspace
to an Apache-2.0 member of it.

All five take the same adjective, chosen once: `licence-gated`, the
tree's established spelling for cloud's variant (plugin-security
README.md, plugin-auth/src/tenancy-service.ts,
service-cluster/src/multi-node-gate-mount.ts,
spec/src/kernel/platform-capabilities.ts, and the CHANGELOGs of four
packages all read "a private, licence-gated subclass"). Where the
adjective sat on the bare package NAME the referent noun `subclass` is
added with it, so the gate attaches to the variant and never to the
Apache-2.0 package.

Comment prose only: no runtime string, no export, no test assertion and
no behaviour moves.

Claude-Session: https://claude.ai/code/session_01CqmCgU5RGDoJYhHUMVp2af
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/core/src/security/resolve-authz-context.test.ts

@@ -1601,7 +1601,7 @@ describe('the in-memory ObjectQL double honours `limit` (#10978)', () => {
  *
  * ## What was measured, before the guard existed
  *
- * On a live `isolated` boot with the real cloud-private `Organizations` plugin
+ * On a live `isolated` boot with the real licence-gated `Organizations` plugin
  * and a file-backed sqlite store, a session whose owner had been removed
  * through better-auth's OWN `/organization/remove-member` — driven by the org
  * owner, 200, the `sys_member` row really deleted — went on READING that

packages/core/src/security/resolve-authz-context.ts

@@ -480,7 +480,7 @@ export async function resolveAuthzContext(input: ResolveAuthzInput): Promise<Res
   // The block above asks "is this stamped organization still backed by a
   // membership?" and, until this card, asked it ONLY of an API key. A browser
   // session's `activeOrganizationId` reached `ctx.tenantId` unread: measured on
-  // a live `isolated` boot with the real cloud-private `Organizations` plugin,
+  // a live `isolated` boot with the real licence-gated `Organizations` plugin,
   // a session whose owner had been removed through better-auth's OWN
   // `/organization/remove-member` (driven by the org owner, 200, the
   // `sys_member` row really deleted) went on READING that organization's rows

packages/rest/src/rest-api-plugin.ts

@@ -297,9 +297,9 @@ export function createRestApiPlugin(config: RestApiPluginConfig = {}): Plugin {
             // organization's rows (GET 200) and WROTE a new one into it (POST
             // 201, the row read back from the store carrying the other
             // organization's id). objectstack#15163 measured it on the
-            // framework; cloud#1982 reproduced it with the real, cloud-private
-            // `@objectstack/organizations` mounted, which adds no request-time
-            // refusal of its own.
+            // framework; cloud#1982 reproduced it with the real, licence-gated
+            // `@objectstack/organizations` subclass mounted, which adds no
+            // request-time refusal of its own.
             //
             // ## Why this is NOT `authServiceProvider`'s catch-all
             //

packages/rest/src/single-kernel-isolated-api-key-matrix.test.ts

@@ -18,10 +18,10 @@
  * | organization-less key             | **200 total 0 (silent) · 403** | **401** |
  *
  * objectstack#15163 measured it on the framework; cloud#1982 reproduced it on
- * `apps/objectos-ee` with the REAL cloud-private `@objectstack/organizations`
- * mounted, reading the written row back out of the sqlite file — the enterprise
- * plugin adds no request-time refusal, so the blast radius was every walled
- * deployment.
+ * `apps/objectos-ee` with the REAL licence-gated `@objectstack/organizations`
+ * subclass mounted, reading the written row back out of the sqlite file — the
+ * enterprise plugin adds no request-time refusal, so the blast radius was
+ * every walled deployment.
  *
  * ## Why the fixture is shaped the way it is
  *

packages/rest/src/single-kernel-isolated-session-org-claim-matrix.test.ts

@@ -8,9 +8,10 @@
  * ## What was measured, before this guard existed
  *
  * On a real `objectstack serve` of cloud's `apps/objectos-ee` — 44 plugins, the
- * REAL cloud-private `@objectstack/organizations`, `Tenancy: isolated`,
- * `SqlDriver(better-sqlite3)` on a FILE — a browser session whose
- * `activeOrganizationId` pointed at an organization its owner had LEFT:
+ * REAL licence-gated `@objectstack/organizations` subclass,
+ * `Tenancy: isolated`, `SqlDriver(better-sqlite3)` on a FILE — a browser
+ * session whose `activeOrganizationId` pointed at an organization its owner
+ * had LEFT:
  *
  * | after the membership ended | GET | POST | the row, read back from the sqlite file |
  * |:--|:--|:--|:--|