chore(spec): classify permission.objects.allowExport in liveness registry (#3544)

The new allowExport property on ObjectPermissionSchema is a governed-type
property and must carry a liveness classification. It is `live` — enforced
end-to-end via the hono /me/permissions annotate (userExportAllowed) → effective
apiOperations → REST export gate + UI. Fixes the "Spec property liveness" gate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012L8EfEa157Pe6C73qRnaJH

Author: claude

packages/spec/liveness/permission.json

@@ -49,6 +49,11 @@
           "status": "live",
           "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts:8"
         },
+        "allowExport": {
+          "status": "live",
+          "evidence": "packages/plugins/plugin-hono-server/src/hono-plugin.ts (annotateEffectiveApiOperations: userExportAllowed = allowExport !== false) + packages/spec/src/data/api-derivation.ts (export derives from list ∧ userExportAllowed)",
+          "note": "#3544 — user-level export axis over read. Enforced end-to-end: the bit drives userExportAllowed, which removes `export` from the object's effective apiOperations on /me/permissions; the frontend hides Export and the REST export gate 405s. Optional/no-default = backward-compatible opt-out (unset inherits read); `false` denies export while keeping read."
+        },
         "allowTransfer": {
           "status": "live",
           "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts (OPERATION_TO_PERMISSION transfer→allowTransfer + modifyAllRecords bypass)",