docs(qa): access-security ledger edits from the 18.2.0 sweep, part 2

The remaining 22 items of #25835 re-read on main and revised: automated.ref
now names what each pin asserts and at which layer, the no-active-org
producers follow #25626, and the share-link landing page drops the retired
objectui pin.

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GgKuGD9Ats95jBbJRZrf4a

Author: claude