docs(deployment): reconcile the gate section with the four doors, the real rule count and the retired alias rule (#7465)

Three drifts between `validating-metadata.mdx` and `cli.mdx`, fixed in one
commit because the first of them cannot be fixed in one file.

1. `## The one gate, three entry points` → `## The one gate, four doors`.
   Since #4463 P1 the table has four columns: the three CLI commands plus the
   runtime publish gate. "Entry points" cannot absorb the fourth — the section's
   own prose says that door "is not a command" — so the noun the section already
   uses for the superset ("There is a fourth door") becomes the heading.

   The rename is a three-site coordinated edit: heading, anchor fragment and
   link text. `cli.mdx:458` carried all of the last two, so it moves in the same
   commit; renaming the heading alone would have left a dead fragment and a link
   whose text contradicted its destination. Repo-wide grep for the old anchor
   and the old phrase found exactly these two sites.

2. The quoted `os validate` transcript read `Running author-time rules (26)`.
   That line prints `authoringRulesFor('validate').length`, measured at 38 by
   executing the registry — not the 26 of the #4409-era audit. The neighbouring
   "23 of 26 rules" sentence is a statement about that historical audit and is
   deliberately left alone.

3. `cli.mdx` still advertised `deprecated visibility aliases` among `os lint`'s
   advisories. `visibility-alias-deprecated` was retired by #6318; every
   remaining mention in the tree is commentary about the retirement, a test
   pinning it, a CHANGELOG entry or the changeset. The docs promised a lint
   output that can never appear, so the item is dropped.

Fixes #7465

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019qshjWWLkvNTRTSyoj8KdQ

Author: claude

content/docs/deployment/cli.mdx

@@ -455,7 +455,7 @@ os validate path/to/config   # Validate specific file
 name/action/filter references, page sources, approval approvers, security
 posture, the autonumber and view-reference lints. All of them come from one
 registry, so the list is the same on `os build` and `os lint`; see
-[The one gate, three entry points](/docs/deployment/validating-metadata#the-one-gate-three-entry-points)
+[The one gate, four doors](/docs/deployment/validating-metadata#the-one-gate-four-doors)
 for the full matrix. Every failing rule is reported in a single run rather than
 stopping at the first, so one pass shows the whole hole.
 
@@ -469,8 +469,7 @@ stopping at the first, so one pass shows the whole hole.
 - No objects defined
 - No apps or plugins defined
 - Every advisory the rule registry raised (dangling `stageField` /
-  `highlightFields` pointers, replay-unsafe seeds, ambiguous flow status,
-  deprecated visibility aliases, …)
+  `highlightFields` pointers, replay-unsafe seeds, ambiguous flow status, …)
 
 <Callout type="tip">
 `os validate`, `os build` and `os lint` share one rule registry, so a config that

content/docs/deployment/validating-metadata.mdx

@@ -346,7 +346,7 @@ Skipped, to keep false positives at zero: the same set as §8 — non-static
 values, `{...spread}` usages, relationship paths, system fields, and objects
 another package defines.
 
-## The one gate, three entry points
+## The one gate, four doors
 
 `os validate`, `os build` (alias of `os compile`) and `os lint` run the **same**
 author-time rules, from one table — `AUTHORING_RULES` in
@@ -479,7 +479,7 @@ A clean run walks the registry and reports timing:
   Config: /path/to/support-desk/objectstack.config.ts
   Load time: 21ms
   → Validating against ObjectStack Protocol...
-  → Running author-time rules (26)...
+  → Running author-time rules (38)...
   → Checking capability providers (#3366)...
   → Checking package docs (ADR-0046)...