chore(ci)(deps): bump codelytv/pr-size-labeler from 1.10.1 to 1.10.3 - #23

The packed-tarball smoke asserted that the first POST /auth/sign-up/email
after `objectstack dev --fresh` returns 200 — an expectation authored
before #11739/#11767 made `invite_only` the default audience posture.

It is not the first account that reaches that probe. `--fresh` seeds a dev
admin in-process at boot through the real signUpEmail pipeline, and THAT
creation is the zero-user one the bootstrap bypass admits. The smoke's own
sign-up is the SECOND self-serve account, which invite_only refuses with
SELF_REGISTRATION_CLOSED + 403 — correctly. The release candidate had
therefore never once passed this gate with the posture default aboard.

Per the maintainer-approved ruling (option A, director batch #23):

  - assert the seeded admin can SIGN IN, which is the packed install's
    proof that the bootstrap bypass really fired;
  - assert the uninvited second self-serve sign-up is REFUSED, pinning
    both the 403 and the envelope code so an accidental widening of the
    unauthenticated surface reds the RC instead of shipping;
  - obtain the non-admin probe user through the operator path (the
    invitation carve-out) before the existing session/CRUD probes.

Behaviour only — no vendor-internal symbol is pinned, and no auth or
audience runtime code is touched.

The posture is READ from the artifact's own public /auth/config rather
than hard-coded, because the two smoke modes install different products:
`registry` smokes the last PUBLISHED release, and plugin-auth 17.2.0
(2026-08-23) predates #11767 (2026-08-25). In `pack` mode the advertised
posture must BE invite_only; in both modes enforcement must match what
the artifact advertises.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

…rocess

Maintainer ruling 2026-09-03 (decision batch #23, B + C): a 5xx the platform
chose because an optional service is not installed is a configuration fact, not
a fault — it is reported once per route per process at `warn`, naming the
missing service. Everything else reaching `logServerFault` keeps its
per-request `error` line.

The predicate is applied inside the shared funnel rather than spelled at each
door, so the REST writer and the runtime dispatcher read the same answer by
construction. It reuses `declaresServerFault`, the repo's existing declared-5xx
vocabulary, and the ADR-0112 code the producer already declared.

Claude-Session: https://claude.ai/code/session_01TSf4DV7ziu4V5j73e46b7c
Co-authored-by: Claude <noreply@anthropic.com>