docs(runtime): endpoint-policy's anonymous 401 comment names the dispatcher envelope, not "the platform's" (#5800)

`anonymousDenial()`'s docstring claimed "same code, same message, same
envelope". The first two hold; the third does not: `apiErrorResponse` builds
the dispatcher wrapper `{ success: false, error: { code, message, httpStatus } }`,
while the REST seam (`@objectstack/rest` `enforceAuth` → `ANONYMOUS_DENY_BODY`)
answers the flat `{ error, message }`. Two live, sanctioned envelopes per
ADR-0112's 2026-07-30 amendment (#4007).

This is the same false claim #5632 narrowed on `ANONYMOUS_DENY_BODY`, surviving
on the side that PRODUCES the wrapper — where a reader (especially an AI author)
takes it as authoritative. Comment only; the wire body is untouched, and the
two-envelope table stays single-sourced in `security/anonymous-deny.ts`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wbxm29qPKnLf44AbSxizqW

Author: claude

packages/runtime/src/endpoint-policy.ts

@@ -270,7 +270,23 @@ export function computeCacheControl(
     return `private, max-age=${Math.floor(ttl)}`;
 }
 
-/** The 401 every seam on this platform answers — same code, same message, same envelope. */
+/**
+ * The anonymous 401 this seam answers: the same DECISION, {@link ANONYMOUS_DENY_CODE}
+ * and {@link ANONYMOUS_DENY_MESSAGE} as every other seam — in the **dispatcher's**
+ * envelope, `{ success: false, error: { code, message, httpStatus } }`, which is
+ * what `apiErrorResponse` builds.
+ *
+ * NOT the platform's only 401 body, and this comment used to say it was ("same
+ * code, same message, same envelope"). The REST seam — `@objectstack/rest`'s
+ * `enforceAuth`, writing `ANONYMOUS_DENY_BODY` — answers the flat
+ * `{ error, message }`. Both envelopes are live and sanctioned by ADR-0112's
+ * 2026-07-30 amendment (#4007); converging them is a breaking wire change owned
+ * by the envelope-convergence line (#3843 family), not by this function. The
+ * full two-envelope table lives on `ANONYMOUS_DENY_BODY`
+ * (`@objectstack/core`, `security/anonymous-deny.ts`), narrowed there by #5632
+ * — this was the same claim surviving on the side that PRODUCES the wrapper,
+ * where it reads as authoritative (#5800).
+ */
 function anonymousDenial(): EndpointPolicyVerdict {
     const { status, body } = apiErrorResponse({
         code: ANONYMOUS_DENY_CODE,