test(plugin-form): the write census enters the Setup catalog's three write sites this branch adds (objectui#7611)

Merging main brought objectui#12082's write census, which counts every
DataSource write call site in the console tree. This branch adds three:
the position holders' add and remove (sys_user_position) and the catalog
switch's row write (catalog-activation's writeCatalogActive). Each is
entered as `unmapped`, the same entry the census gives the sibling
permission-set assignment section (AssignedUsersSection): none reads a
CRUD grant on its object. The switch is offered on the caller's
manage_metadata gate.

Claude-Session: https://claude.ai/code/session_01Rerax7QTjKMPCUZxQUtPFR
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugin-form/src/affordanceGrantMap-12082.test.tsx

@@ -525,6 +525,12 @@ const WRITE_SITES: Record<string, WriteSite> = {
     unmapped("Setup's permission-set assignment creates sys_user_permission_set rows and reads no grant on that object"),
   'packages/app-shell/src/views/metadata-admin/AssignedUsersSection.tsx :: AssignedUsersSection > removeUser :: delete':
     unmapped("Setup's permission-set assignment deletes sys_user_permission_set rows and reads no grant on that object"),
+  'packages/app-shell/src/views/metadata-admin/PositionHoldersSection.tsx :: PositionHoldersSection > addHolders :: create':
+    unmapped("Setup's position assignment creates sys_user_position rows and reads no grant on that object"),
+  'packages/app-shell/src/views/metadata-admin/PositionHoldersSection.tsx :: PositionHoldersSection > removeHolder :: delete':
+    unmapped("Setup's position assignment deletes sys_user_position rows and reads no grant on that object"),
+  'packages/app-shell/src/views/metadata-admin/catalog-activation.ts :: writeCatalogActive :: update':
+    unmapped("the Setup catalog's active switch updates the sys_permission_set / sys_position row's active flag; it is offered on the caller's manage_metadata gate (useCanAuthorMetadata), and reads no update grant on that object"),
   // ── core ──
   'packages/core/src/actions/TransactionManager.ts :: TransactionManager > executeBatch :: batch':
     door('the action engine\'s transaction executor runs the operations its caller hands it'),