chore: bump objectui to a136322f8723 — the console must carry the ADR-0110 D1 fix before v17 ships (#3982)

The pin was at 4a4829d0ef39, an ancestor of objectui#2970 (the ADR-0110 D1
client fix). build-console.sh builds the shipped SPA at the PINNED sha, so v17
would have gone out with a console that still posts action.target to
/actions/:object/:action. A v17 server resolves the declaration by name and
refuses an unresolvable one (D3), so every target-bound script action would
404 from the shipped console — a regression on a path that worked before.

The ADR and both PRs called for lockstep; the mechanism that enforces it is
this pin, which merging the objectui PR does not touch, and check:console-sha
guards dist-vs-pin drift rather than pin-vs-upstream staleness.

Range also carries objectui#2973 (modal actions are client-only) and eight
other fixes since the last bump.

After merging, a local checkout needs `pnpm objectui:build` (rebuild at the
pinned SHA) — not `objectui:refresh`.

Author: os-zhuang

.changeset/console-a136322f8723.md

@@ -0,0 +1,26 @@
+---
+"@objectstack/console": minor
+---
+
+Console (objectui) refreshed to `a136322f8723`. Frontend changes in this range:
+
+- fix(app-shell)!: a modal action is client-side only — drop the server fallthrough (objectstack#3959) (#2973)
+- fix(app-shell)!: the server-action URL identifies an action by `name`, not `target` (ADR-0110 D1) (#2970)
+- fix(form): a server rejection that names fields now marks those fields (#2966)
+- fix(actions): one source for the /actions envelope rule, and redirectUrl finally works (#2967)
+- fix(actions): apply the ADR-0066 D4 capability gate on every action surface (framework#3923) (#2965)
+- fix(detail): multi-value lookup is selectable in inline edit (#2957)
+- fix(actions): a failed server action no longer reports as success (green toast) (#2963)
+- fix(fields): the criteria builder stops calling an empty criteria "All records" (#2962)
+- feat(report): carry a report's `order` into the dataset selection (framework#3916) (#2964)
+- feat(views): the list toolbar speaks one vocabulary — `userActions` (#2890) (#2948)
+
+objectui range: `4a4829d0ef39...a136322f8723`
+
+**Release-critical for v17.** The previous pin (`4a4829d0ef39`) predates the
+ADR-0110 D1 client fix, so the console it builds still posts `action.target`
+to `/api/v1/actions/:object/:action`. Against a v17 server — which resolves
+the declaration by `name` and refuses an unresolvable one (D3) — every
+target-bound script action would return 404 from the shipped console. The
+lockstep the ADR called for is enforced by THIS pin, not by merging the
+objectui PR, so v17 must not ship without this bump.

.objectui-sha

@@ -1 +1 @@
-4a4829d0ef3926e9b55757bfb1e369d6dca61ac2
+a136322f872314a74462ac7e7142f424e1124400