feat(namespace): write-door forgery refusal (user metadata keys may never start 'system.') + refusal messages name both spellings in every branch (the non-colliding case marks system.<f> honestly as NOT valid) — cross-engine message pin alignment

src/db/fieldAddressing.ts

@@ -247,7 +247,8 @@ export function buildUnresolvableMessage(
   return (
     `no metadata field '${raw}' on this store — nothing carries it, so an ordered or ` +
     `filtered read against it cannot mean anything. Spell it metadata.${raw} once the ` +
-    `field exists, or check the field name.`
+    `field exists, or check the field name (system.${raw} is NOT valid — '${raw}' is ` +
+    `not one of the engine's system scalars).`
   )
 }