fix(changeset, spec): cut the write universals an OR-sibling policy falsifies

Measured at the merged head on driver-sql: beside a sibling policy whose
check admits, a policy carrying a list comparand is dropped and the sibling
alone decides, so the forbidden insert is admitted. Two sentences claimed
otherwise and are cut, with no replacement prose: the rest of the 2a
changeset's span-1 sentence ("Both shapes now fail the write"), and the
2a entry's acceptanceCriteria universal, the same sentence class this PR's
own entry lost in the previous commit. registry.ts regenerated.

Claude-Session: https://claude.ai/code/session_01Sfe5YjBLwB9J3y8fvm2xq1
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/19886-formula-array-comparand-refused.md

@@ -15,7 +15,7 @@ Clause-②: no (narrowing)
 - a `check` written `record.status != ['closed', 'archived']`, or `!=` against a `current_user` membership array, lowered to `{ status: { $ne: [...] } }` and matched **every** post-image;
 - a `check` written `!(record.status == ['closed', 'archived'])` lowered to `{ $not: { status: [...] } }` and did the same.
 
-Every write such a policy was written to refuse was admitted and stored. Both shapes now fail the write. The positive `record.status == ['open', 'pending']` already refused every write (403).
+Every write such a policy was written to refuse was admitted and stored. The positive `record.status == ['open', 'pending']` already refused every write (403).
 
 The message withholds the field, the operator and the value, because the filter is usually an access policy the caller did not write, and the comparand may be a resolved membership set.
 

packages/spec/src/migrations/entries/semantic/18.rls-predicate-array-comparand-refused.ts

@@ -42,9 +42,7 @@ export const entry: SemanticMigration = {
   acceptanceCriteria:
     'Grep the rowLevelSecurity check and using predicates of your permission sets for != or == '
     + 'whose right-hand side is a list literal or a current_user membership array, and for the '
-    + 'negation of such an ==, then rewrite each with in or !(... in ...). A check that still '
-    + 'carries the shape refuses every write it governs, allowed '
-    + 'values included, so one allowed write under each policy finds every such check left. '
+    + 'negation of such an ==, then rewrite each with in or !(... in ...). '
     + 'Then re-check what each policy is supposed to refuse rather than assuming the writes it '
     + 'admitted before were right: before this change a != or a negated == against a list '
     + 'admitted every write.',

packages/spec/src/migrations/registry.ts

@@ -11603,9 +11603,7 @@ const step18: MigrationStep = {
       acceptanceCriteria:
         'Grep the rowLevelSecurity check and using predicates of your permission sets for != or == '
         + 'whose right-hand side is a list literal or a current_user membership array, and for the '
-        + 'negation of such an ==, then rewrite each with in or !(... in ...). A check that still '
-        + 'carries the shape refuses every write it governs, allowed '
-        + 'values included, so one allowed write under each policy finds every such check left. '
+        + 'negation of such an ==, then rewrite each with in or !(... in ...). '
         + 'Then re-check what each policy is supposed to refuse rather than assuming the writes it '
         + 'admitted before were right: before this change a != or a negated == against a list '
         + 'admitted every write.',