fix(objectql): respect packageId filter when merging MetadataService items in getMetaItems

When protocol.getMetaItems() was called with a packageId filter,
SchemaRegistry.listItems() correctly filtered by package, but the
subsequent MetadataService.list() merge added ALL runtime items from
ALL packages without filtering. This caused the Studio sidebar to
show the same objects regardless of which package was selected.

Now both protocol.getMetaItems() and HttpDispatcher.handleMetadata()
filter MetadataService items by _packageId when a package scope is
requested.

Agent-Logs-Url: https://github.com/objectstack-ai/framework/sessions/2c649f38-8bbb-4a1e-ac27-6c8f2994cab2

Co-authored-by: xuyushun441-sys <255036401+xuyushun441-sys@users.noreply.github.com>

Author: Copilot

CHANGELOG.md

@@ -26,6 +26,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
     - Preserved skill independence — Each skill remains independently installable/referenceable (no global routing required)
 
 ### Fixed
+- **Studio: Package switcher not filtering object list** — Fixed a bug where switching packages in the Studio left sidebar did not change the displayed object list. The root cause was in `ObjectStackProtocolImplementation.getMetaItems()`: after filtering items by `packageId` via `SchemaRegistry.listItems()`, the code merged in ALL runtime items from MetadataService without respecting the `packageId` filter, effectively overriding the filtered results. The same issue existed in `HttpDispatcher.handleMetadata()` where the MetadataService fallback path also ignored `packageId`. Both paths now correctly filter MetadataService items by `_packageId` when a package scope is requested.
 - **CI: Replace `pnpm/action-setup@v6` with corepack** — Switched all GitHub Actions workflows (`ci.yml`, `lint.yml`, `release.yml`, `validate-deps.yml`, `pr-automation.yml`) from `pnpm/action-setup@v6` to `corepack enable` to fix persistent `ERR_PNPM_BROKEN_LOCKFILE` errors. Corepack reads the exact `packageManager` field from `package.json` (including SHA verification), ensuring the correct pnpm version is used in CI. Also bumped pnpm store cache keys to v3 and added a pnpm version verification step.
 - **Broken pnpm lockfile** — Regenerated `pnpm-lock.yaml` from scratch to fix `ERR_PNPM_BROKEN_LOCKFILE` ("expected a single document in the stream, but found more") that was causing all CI jobs to fail. The previous merge of PR #1117 only included workflow cache key changes but did not carry over the regenerated lockfile.
 - **service-ai: Fix navigation item labels using deprecated i18n object format** — Replaced `{ key, defaultValue }` i18n objects with plain string labels in `AIServicePlugin`'s Setup App navigation contributions, completing the `I18nLabelSchema` migration from [#1054](https://github.com/objectstack-ai/framework/issues/1054).

packages/objectql/src/protocol.ts

@@ -253,7 +253,14 @@ export class ObjectStackProtocolImplementation implements ObjectStackProtocol {
             const services = this.getServicesRegistry?.();
             const metadataService = services?.get('metadata');
             if (metadataService && typeof metadataService.list === 'function') {
-                const runtimeItems = await metadataService.list(request.type);
+                let runtimeItems = await metadataService.list(request.type);
+                // When filtering by packageId, only include runtime items that
+                // belong to the requested package. MetadataService.list() returns
+                // items from ALL packages, so we must filter here to respect the
+                // package scope requested by the caller (e.g., Studio sidebar).
+                if (packageId && runtimeItems && runtimeItems.length > 0) {
+                    runtimeItems = runtimeItems.filter((item: any) => item?._packageId === packageId);
+                }
                 if (runtimeItems && runtimeItems.length > 0) {
                     // Merge, avoiding duplicates by name
                     const itemMap = new Map<string, any>();

packages/runtime/src/http-dispatcher.ts

@@ -534,7 +534,12 @@ export class HttpDispatcher {
             const metadataService = await this.getService(CoreServiceName.enum.metadata);
             if (metadataService && typeof (metadataService as any).list === 'function') {
                 try {
-                    const items = await (metadataService as any).list(typeOrName);
+                    let items = await (metadataService as any).list(typeOrName);
+                    // Respect package filter: MetadataService.list() returns ALL items,
+                    // so filter by _packageId when a specific package is requested.
+                    if (packageId && items && items.length > 0) {
+                        items = items.filter((item: any) => item?._packageId === packageId);
+                    }
                     if (items && items.length > 0) {
                         return { handled: true, response: this.success({ type: typeOrName, items }) };
                     }