Sync before merging so CI validates the real merge result — main picked up a
@object-ui/types refactor (#2985) and two plugin-form wizard changes while this
branch was in flight.

…aring one navigator (#2944) (#2994)

The last open item of #2944. `ActionRunner` dispatched a seventh action type,
`navigation`, that `@objectstack/spec`'s `ActionType` does not contain. The issue
asked to promote it upstream or delete the case. Neither, as stated.

Promoting is wrong: the spec already names this operation — `type: 'url'`, with
`openIn` for the new-tab choice — so a seventh type would put a second spec name
on one operation, which is the failure this audit exists to describe, committed
one level up. Deleting is worse because it is silent: `{ type: 'navigation',
to: … }` is authored today (`element:button` CTAs), and without the case the
action falls through to `executeActionSchema`, which returns `{ success: true }`
— a green toast that navigates nowhere (#2960's trap).

The alias had already drifted, which is the actual finding. `executeNavigation`
was quietly the weaker of two implementations of one concept: no `${param.X}`
interpolation, `openIn` ignored, no `/api/…` full-page short-circuit. So
`{ type: 'navigation', to: '/x?p=${param.p}' }` shipped the literal
`${param.p}` while the identical `url` action resolved it.

So it stays and stops being dialect. `ObjectUiLocalActionType` /
`OBJECTUI_LOCAL_ACTION_TYPES` declare it as objectui's own alias of `url` — the
treatment #2985 gave the page-visualization names — and both names now route
through one `navigateTo`. `url` gains `replace` pass-through, the one modifier
only the alias carried; `replace` is omitted from the `NavigationHandler`
options when unset, so hosts see the shape they already saw.

The guard is structural rather than another assertion: built-in dispatch is a
table typed `Record<RunnableActionType, …>` instead of a `switch`, so an
`ActionType` the spec ADDS stops compiling until an executor exists for it —
#2942's "validates at save, renders nothing at run time" class, made a build
error for actions. `spec-derived-unions.test.ts` additionally asserts
`navigation` is absent from the spec enum, so the day it is adopted upstream the
test fails and names the alias to retire.

Also covers the `/api/` short-circuit and `apiBase` promotion, which had none —
the project runs in a node env with no `window`, which is why — and corrects the
audit doc's Direction B row, which still prescribed promoting.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>