feat(env): polish detail page — kill 'Admin config' badge, surface Install CTA, add visible CEL predicates

- sys_environment.managedBy: 'config' → 'platform'. Environments are user-owned
  resources (their cloud envs), not admin configuration. The 'config' bucket
  surfaced a misleading 'Admin config' badge in the detail header that made
  the page feel like an internal admin tool. The runtime affordances (no
  New button — provision-via-action only) are still enforced via the
  existing userActions block.
- Reorder actions so install_application is FIRST, promoting it from the
  '更多操作 / More' dropdown into the visible record-header toolbar. This
  answers the most common post-create question: 'I just made an env, now
  what?'.
- Add 'visible' CEL predicates to status-machine actions so renderers that
  honour them hide no-ops (Suspend on suspended, Resume on active,
  Set-as-Default on the default env, install/change/archive on archived
  envs). Verified live via chrome-devtools: Resume and Archive no longer
  appear in the header/dropdown on an active env; only Suspend does.

Verified via Console UI at http://localhost:4100/_console/apps/cloud_control/sys_environment:
- header: 编辑 · Install Application · Suspend · 更多操作
- 更多操作 dropdown: Set as Default · Change Plan · Change Hostname · Archive · 分享
- no 'Admin config' badge

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: hotlong

packages/services/service-tenant/src/objects/sys-environment.object.ts

@@ -44,7 +44,11 @@ export const SysEnvironment = ObjectSchema.create({
   pluralLabel: 'Environments',
   icon: 'globe',
   isSystem: true,
-  managedBy: 'config',
+  // `platform` — these are user-owned resources (their cloud environments).
+  // Previously `config`, which surfaced an "Admin config" badge in the
+  // detail header and made the page feel like an internal admin tool.
+  // Affordances (no New button) are still enforced via userActions below.
+  managedBy: 'platform',
   description: 'Your cloud environments. Each environment has its own URL, database, and plan.',
   titleFormat: '{display_name}',
   compactLayout: ['display_name', 'plan', 'status', 'hostname', 'is_default'],
@@ -192,8 +196,66 @@ export const SysEnvironment = ObjectSchema.create({
       ],
     },
 
+    // ────────────────────────────────────────────────────────────────────
+    // Install Application — primary CTA on an environment detail page.
+    // Solves "I just created an env, now what?": user picks a package
+    // (with a record-picker if the renderer supports it; otherwise paste
+    // its ID) and the package is installed into the current env.
+    //
+    // Listed FIRST so renderers that surface only the top N actions in the
+    // record header (and put the rest under "更多操作 / More") promote this
+    // CTA into the visible toolbar instead of burying it in a dropdown.
+    //
+    // The endpoint is env-keyed (recordIdParam: 'id' → /:id/install-package)
+    // so a record-header click already knows the target env and only needs
+    // to collect the package_id + optional seed flag.
+    // ────────────────────────────────────────────────────────────────────
+    {
+      name: 'install_application',
+      label: 'Install Application',
+      icon: 'download-cloud',
+      variant: 'primary',
+      type: 'script',
+      locations: ['list_item', 'record_header'],
+      target: 'install_application',
+      // Only meaningful for an env you can actually deploy to. Hide while the
+      // environment is being provisioned, has failed, or has been archived.
+      // (Forward-compat: evaluated when the renderer supports `visible` CEL.)
+      visible: 'status == "active" || status == "suspended"',
+      successMessage: 'Application installed. Open your environment to see it.',
+      refreshAfter: true,
+      params: [
+        {
+          // Borrow the typed lookup config from sys_package_installation
+          // so renderers that support it can show a record picker;
+          // otherwise users can paste the Package ID from the Marketplace.
+          name: 'package_id',
+          field: 'package_id',
+          objectOverride: 'sys_package_installation',
+          label: 'Application',
+          type: 'lookup',
+          required: true,
+          placeholder: 'Pick an application from the Marketplace',
+          helpText: 'Application package to install. Browse the Marketplace tab to see what is available.',
+        },
+        {
+          name: 'seed_sample_data',
+          label: 'Include sample data',
+          type: 'boolean',
+          required: false,
+          defaultValue: false,
+          helpText: 'Pre-populate the environment with the package\'s demo records ' +
+            '(e.g. example Accounts, Contacts, Leads) so you can explore the app immediately. ' +
+            'Recommended for first-time users; leave unchecked for a clean production environment.',
+        },
+      ],
+    },
+
     // ────────────────────────────────────────────────────────────────────
     // Status-machine row actions (replace direct status field edits).
+    // Each carries a `visible` CEL predicate so renderers that honour it
+    // hide the action when it would be a no-op (Suspend on a suspended
+    // env, Resume on an active env, Set-as-Default on the default env).
     // ────────────────────────────────────────────────────────────────────
     {
       name: 'suspend_environment',
@@ -202,6 +264,7 @@ export const SysEnvironment = ObjectSchema.create({
       variant: 'secondary',
       type: 'script',
       locations: ['list_item', 'record_header'],
+      visible: 'status == "active"',
       confirmText: 'Suspend this environment? All runtime traffic to it will be blocked until you resume.',
       successMessage: 'Environment suspended.',
       refreshAfter: true,
@@ -213,30 +276,18 @@ export const SysEnvironment = ObjectSchema.create({
       variant: 'secondary',
       type: 'script',
       locations: ['list_item', 'record_header'],
+      visible: 'status == "suspended"',
       successMessage: 'Environment resumed.',
       refreshAfter: true,
     },
-    {
-      name: 'archive_environment',
-      label: 'Archive',
-      icon: 'archive',
-      variant: 'danger',
-      type: 'script',
-      locations: ['list_item', 'record_header'],
-      confirmText: 'Archive this environment? It will be removed from active views. Data is retained for 30 days before deletion.',
-      successMessage: 'Environment archived.',
-      refreshAfter: true,
-      params: [
-        { name: 'reason', label: 'Reason (optional)', type: 'text', required: false },
-      ],
-    },
     {
       name: 'set_default_environment',
       label: 'Set as Default',
       icon: 'star',
       variant: 'secondary',
       type: 'script',
       locations: ['list_item', 'record_header'],
+      visible: 'is_default != true',
       successMessage: 'Default environment updated.',
       refreshAfter: true,
     },
@@ -247,6 +298,7 @@ export const SysEnvironment = ObjectSchema.create({
       variant: 'secondary',
       type: 'script',
       locations: ['list_item', 'record_header'],
+      visible: 'status != "archived"',
       successMessage: 'Plan updated.',
       refreshAfter: true,
       params: [
@@ -272,6 +324,7 @@ export const SysEnvironment = ObjectSchema.create({
       variant: 'secondary',
       type: 'script',
       locations: ['list_item', 'record_header'],
+      visible: 'status != "archived"',
       successMessage: 'Hostname updated.',
       refreshAfter: true,
       params: [
@@ -286,50 +339,19 @@ export const SysEnvironment = ObjectSchema.create({
         },
       ],
     },
-    // ────────────────────────────────────────────────────────────────────
-    // Install Application — primary CTA on an environment detail page.
-    // Solves "I just created an env, now what?": user picks a package
-    // (with a record-picker if the renderer supports it; otherwise paste
-    // its ID) and the package is installed into the current env.
-    //
-    // The endpoint is env-keyed (recordIdParam: 'id' → /:id/install-package)
-    // so a record-header click already knows the target env and only needs
-    // to collect the package_id + optional seed flag.
-    // ────────────────────────────────────────────────────────────────────
     {
-      name: 'install_application',
-      label: 'Install Application',
-      icon: 'download-cloud',
-      variant: 'primary',
+      name: 'archive_environment',
+      label: 'Archive',
+      icon: 'archive',
+      variant: 'danger',
       type: 'script',
       locations: ['list_item', 'record_header'],
-      target: 'install_application',
-      successMessage: 'Application installed. Open your environment to see it.',
+      visible: 'status != "archived"',
+      confirmText: 'Archive this environment? It will be removed from active views. Data is retained for 30 days before deletion.',
+      successMessage: 'Environment archived.',
       refreshAfter: true,
       params: [
-        {
-          // Borrow the typed lookup config from sys_package_installation
-          // so renderers that support it can show a record picker;
-          // otherwise users can paste the Package ID from the Marketplace.
-          name: 'package_id',
-          field: 'package_id',
-          objectOverride: 'sys_package_installation',
-          label: 'Application',
-          type: 'lookup',
-          required: true,
-          placeholder: 'Pick an application from the Marketplace',
-          helpText: 'Application package to install. Browse the Marketplace tab to see what is available.',
-        },
-        {
-          name: 'seed_sample_data',
-          label: 'Include sample data',
-          type: 'boolean',
-          required: false,
-          defaultValue: false,
-          helpText: 'Pre-populate the environment with the package\'s demo records ' +
-            '(e.g. example Accounts, Contacts, Leads) so you can explore the app immediately. ' +
-            'Recommended for first-time users; leave unchecked for a clean production environment.',
-        },
+        { name: 'reason', label: 'Reason (optional)', type: 'text', required: false },
       ],
     },
   ],