fix(approvals): one decision, one dialog — carry reject/recall confirm questions on description - #7592

…irm questions on `description` (objectstack-ai#7309) (objectstack-ai#7827)

The console action runner chains confirmation THEN param collection, both
awaited, so an action declaring `confirmText` *and* `params` opened two
sequential dialogs for one click — nothing sent until the second, while the
first already read as "the action ran".

Follows the maintainer's 2026-08-10 ruling on objectstack-ai#7278 (shipped in PR objectstack-ai#7592):
carry the confirm question on the action's top-level `description` (objectstack-ai#7367) and
drop `confirmText`. Sweeps the 14 remaining in-repo action sites, all in
`identity/`. Each question moves verbatim — no warning reworded, none dropped.

`confirmText` is left in place where it is still correct: a param-LESS action
has no param dialog to fold into, so the confirm is its only dialog.

The en/zh-CN/ja-JP/es-ES bundles move the same 14 leaves by hand, because
`os i18n extract --fill=default` would seed English over the curated
translations for a renamed key — invisible to `check:i18n`.

Tests pin the consequence in both directions: params ⇒ one dialog, and the
question is still shown. Deleting a warning instead of moving it goes red.

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: os-zhuang <jack@objectstack.ai>

… scoped by schema boundary (objectstack-ai#7972)

* feat(spec): refuse `confirmText` + non-empty `params` on ActionSchema

An action declaring both opens TWO sequential dialogs for one decision —
the console runner awaits the confirm, then the param prompt, so the first
already reads as "the action ran" while nothing has been sent.

objectstack-ai#7278 and objectstack-ai#7309 repaired the 16 shipped sites (PRs objectstack-ai#7592, objectstack-ai#7827); neither
stops the next one being written. This is the structural half: a refusal on
ActionSchema whose message names both keys and points the confirm question
at the action's top-level `description`.

Scoped by schema boundary, not by a param-optionality heuristic. The pair is
INTENDED on `BulkActionDefSchema`, where params and confirm render one dialog
(a `required` param blocks that dialog's own Confirm button), so the four
`examples/app-showcase` bulk defs are correct as written. The refusal lives on
ActionSchema's refine chain and is structurally incapable of reaching either
`BulkActionDefSchema` or `InlineActionSchema`; both directions are pinned.

* docs(spec): declare the confirmText/params refusal on the key, + changeset

The `confirmText` describe() now names the refusal, so an author meets the
constraint in the generated reference rather than only in the error. Worded
"on a registered action" deliberately: the same field factory renders the
InlineAction reference table, where the guard does not apply — an unqualified
claim there would be a documented refusal that does not exist.

Regenerates content/docs/references/ui/action.mdx (gen:docs).

* docs(objectui): two action examples taught metadata the spec now refuses

`content/docs/protocol/objectui/actions.mdx` showed `disable_oauth_application`
and `rotate_client_secret` pairing `confirmText` with `params`. Both were
already stale — the real actions moved the question to `description` in objectstack-ai#7827 —
and the guard in this PR makes the documented shape fail to parse.

They are labelled "Real-World Examples", so they now mirror what the platform
objects actually ship, and the `confirmText` bullet above them states the
constraint: param-LESS actions only, question on `description` otherwise, not
`ai.description`, and bulk defs unaffected.

Found via the PR's docs-drift list; the brace-balanced census could not see
these because the examples are YAML.

---------

Co-authored-by: Claude <noreply@anthropic.com>