…silently wrong (#2941)

Every row here validated at authoring time and produced output that looked
correct and wasn't (#2901 Tier 1 — worse than a blank cell, because nobody
asks why a plausible number is wrong):

- PivotTable: an out-of-vocabulary aggregation (`count_distinct`,
  `array_agg`, `string_agg` — engine names with no client renderer) returned
  a SUM through the `default:` branch. It now refuses loudly with a visible
  notice; the implemented set is pinned to the spec's 5-name
  `ChartAggregateFunctionSchema`.
- Report chart: 10 of 19 `ChartTypeSchema` values silently drew a bar.
  `planReportChart` now classifies all 19 — the 12 series families reach the
  generic chart verbatim (`horizontal-bar` stays horizontal), the 5
  single-value families render the measure as a server-aggregated number
  (dimensionless dataset query — no client math), `table`/`pivot` add no
  duplicate chart, and out-of-spec values get a visible notice.
- `selection.type: 'single'`: `selectable` was a bare truthy, so single
  rendered the full multi-select UX. The data-table now enforces
  replace-on-select with no select-all header, and ObjectGrid stops offering
  the cross-page "select all N matching" escalation in single mode.
- Filter `type: 'select'`: the spec names both `select` and `multi-select`,
  so `select` is single-choice. It now renders radios and replaces the pick
  (badge × clears); restored/default multi-value selections clamp to one.
  Inferred (omitted) types keep the historical multi-check UX.
- `addRecord.position: 'both'` collapsed to `top` through a binary ternary;
  both buttons now render.
- `tabular` vs `summary` was resolved from whether `rows` was non-empty; the
  DECLARED type now picks the branch: summary (and degraded matrix) carries
  a server-computed grand-total footer (`totals: { groupings: [[]] }`, ADR-0021
  red line respected), tabular is the same selection as a plain list.

Each fix lands with a spec-parity guard per the #2897 template
(`summary-spec-parity.test.ts`) plus behavior tests; `components`,
`plugin-dashboard` and `plugin-report` gain the `@objectstack/spec`
devDependency that makes those guards possible (`components` also pins
`zod@^4` so the spec resolves to the same store instance as the rest of the
repo instead of forking a second `zod@3` peer variant via shadcn's MCP SDK).

Refs #2941, #2901

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>