Grant `manage_org_presentation` to `tenant_admin` once the capability ships in a released @objectstack line

[os-zhuang]

Part of objectstack-ai/objectstack#12701. Chartered by maintainer, 2026-08-27, live PM chat, verbatim: 「发版后把 tenant_admin 那格补上创建卡片」.

What this card does (small, mechanical once unblocked)

src/profiles/tenant-admin.profile.ts (landed in #1362) deliberately dropped the metadata-authoring vocabulary (customize_application / manage_profiles / manage_roles) because the platform's only metadata key was platform-scoped. objectstack-ai/objectstack#12702 (merged via PR #12705) added the org-scoped subset key manage_org_presentation — admits /meta item writes only for allowOrgOverride: true types org-scoped to the caller's own active organization.

When that capability is installable by this repo (hotcrm consumes released @objectstack/* versions, never git pins — the lane's install-surface rule):

1. Bump @objectstack/* dependencies to the release line carrying manage_org_presentation (verify with the probe below, not the changelog).
2. Add manage_org_presentation to TenantAdminProfile.systemPermissions (SaaS composition only; community system_admin untouched — it already holds the wider manage_metadata-era vocabulary).
3. Extend test/saas-composition.test.ts: the profile pin currently asserts tenant_admin holds no scope: 'platform' capability — keep that, and add the positive assertion that manage_org_presentation is granted and is declared scope: 'org' in the installed PLATFORM_CAPABILITIES.
4. Changeset (minor).

Restart-when (executable, checked by the daily hold scan)

Restart-when: node -e "const c=require('@objectstack/spec/package.json').version; const {PLATFORM_CAPABILITIES}=require('@objectstack/spec/security'); process.exit(PLATFORM_CAPABILITIES.some(x=>x.name==='manage_org_presentation')?0:1)" exits 0 after a pnpm update of @objectstack/* to the newest released line in a scratch checkout — i.e. the capability is present in the newest released @objectstack/spec, not merely on main.

Version releases are a human act (AGENTS.md release act); this card wakes on the release, it never asks for one.