chore: changeset + regenerate app reference for defaultAgent doc (#3820)

Check Changeset and the generated-docs gate in TypeScript Type Check both
flagged the previous commit: add the missing changeset (@objectstack/lint
minor, @objectstack/spec patch) and the regenerated
content/docs/references/ui/app.mdx row for the re-documented
`app.defaultAgent`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BHjroNkLkajskKbJaidko4

Author: claude

.changeset/ai-surface-affinity-lint.md

@@ -0,0 +1,33 @@
+---
+"@objectstack/lint": minor
+"@objectstack/spec": patch
+---
+
+feat(lint): `validate-ai-surface-affinity` — skill ↔ agent surface affinity is now linted (#3820)
+
+An agent binds a product surface (`'ask'` | `'build'`, ADR-0063 §1) and a skill
+declares which surface it belongs to (`'ask'` | `'build'` | `'both'`, §3). The
+runtime refuses an incompatible binding with a **load error at chat time** —
+after parse, validate, and deploy all passed cleanly. The new rule reports that
+contradiction statically, and joins `REFERENCE_INTEGRITY_RULES`, so
+`objectstack validate`, `lint`, and `compile` all pick it up with no CLI
+changes.
+
+Scope is deliberately narrow (zero false positives by construction): only
+bindings where **both** the agent and the skill are declared in the same stack
+are checked. `agent.skills[]` names that don't resolve in-stack (kernel skills
+are runtime-registered and statically invisible) are skipped — resolving those
+namespaces is #3820 D0/D2, decided by ADR-0109 (Proposed).
+
+The spec side is doc-truth only, no schema shape changes:
+
+- `stack.agents` is documented as **platform-internal** (ADR-0063 §2 — the
+  kernel ships exactly two agents; third parties extend via skills), replacing
+  prose that still described the withdrawn ADR-0040 per-app-copilot model.
+- `stack.tools` is documented as declaration-only pending the ADR-0109 tool
+  authoring model.
+- `app.defaultAgent` is re-documented as a surface-binding knob (`'ask'`
+  implicit / `'build'` for authoring surfaces), not a custom-agent slot.
+- `SkillSchema` now states that a per-skill `permissions` field deliberately
+  does not exist (ADR-0049) — authoring one is silently stripped; access is
+  gated by `agent.access` / `agent.permissions` and per-tool authz.

content/docs/references/ui/app.mdx

@@ -90,7 +90,7 @@ const result = ActionNavItem.parse(data);
 | **sharing** | `{ enabled?: boolean; publicLink?: string; password?: string; allowedDomains?: string[]; … }` | optional | Public sharing configuration |
 | **embed** | `{ enabled?: boolean; allowedOrigins?: string[]; width?: string; height?: string; … }` | optional | Iframe embedding configuration |
 | **mobileNavigation** | `{ mode?: Enum<'drawer' \| 'bottom_nav' \| 'hamburger'>; bottomNavItems?: string[] }` | optional | Mobile-specific navigation configuration |
-| **defaultAgent** | `string` | optional | Name of the default AI agent for this app (used by the ambient chat endpoint) |
+| **defaultAgent** | `string` | optional | Platform agent bound to this app's ambient chat ('ask' is the implicit default; 'build' for authoring surfaces) — ADR-0063 §1 |
 | **aria** | `{ ariaLabel?: string; ariaDescribedBy?: string; role?: string }` | optional | ARIA accessibility attributes for the application |
 | **protection** | `{ lock: Enum<'none' \| 'no-overlay' \| 'no-delete' \| 'full'>; reason: string; docsUrl?: string }` | optional | Package author protection block — lock policy for this app. |
 | **_lock** | `Enum<'none' \| 'no-overlay' \| 'no-delete' \| 'full'>` | optional | Item-level lock — controls overlay & delete (ADR-0010). |