chore(spec): regenerate the migration registry's generated regions from the merged tree

The merge took main's generated regions; gen:migration-registry puts this
branch's two entries back (retired-key security/RowLevelSecurityPolicy:tags
and the D3 semantic entry permission-rls-tags-retired) beside #20251's.

Claude-Session: https://claude.ai/code/session_01Rjy9MeetSfq34PKn81CRiN
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/spec/src/migrations/registry.ts

@@ -12895,6 +12895,36 @@ const step18: MigrationStep = {
         + 'restore or purge grant — an erasure-request runbook, an access review, an audit control — '
         + 'names the mechanism it actually uses instead.',
     },
+    // #20321 (ADR-0049 enforce-or-remove) — the D3 entry of the
+    // `permission-rls-tags-removed` family (ruling B on #17152: one D3 entry per
+    // retirement family, even when D2 is lossless). The strip changes no access
+    // decision; what it leaves is whatever process was built on the belief that a
+    // policy's tags were read.
+    {
+      id: 'permission-rls-tags-retired',
+      surface: 'permission.rowLevelSecurity[].tags — the free-form categorization tags on a row-level '
+        + 'security policy',
+      replacement: '(removed — no mainstream platform tags a row-level policy, and nothing here ever '
+        + 'read one.) A policy is identified by its `name` and its `object`, and reported by those and '
+        + 'its predicate; its purpose belongs in `description`. Whom a policy applies to is decided by '
+        + '`positions`, never by a tag.',
+      reason: 'The D2 conversion `permission-rls-tags-removed` deletes `tags` from every row-level '
+        + 'security policy in author sources and in stored permission rows, and the delete is '
+        + 'lossless: the RLS compiler never consulted the key and nothing else acted on it — no '
+        + 'report, audit filter or review queue selected on it — so no access decision changes. '
+        + 'The judgment is about what people '
+        + 'believed. An admin who tagged a policy `gdpr` or `pci` may have expected a compliance '
+        + 'report, an audit filter or a review queue to pick it up; none ever did. An author who '
+        + 'wrote a tag such as `managers_only` may have believed it scoped the policy; it never did '
+        + '— only `positions` narrows whom a policy applies to. Any report, runbook or control that '
+        + 'relies on either belief needs another path, and choosing that path is a governance '
+        + 'decision no conversion can make.',
+      acceptanceCriteria: 'No authored or stored row-level security policy carries `tags`; the parse '
+        + 'refuses the key with the prescription. Access decisions are unchanged: every policy admits '
+        + 'and refuses exactly the rows it did before the upgrade. Every policy whose tag expressed an '
+        + 'audience has that audience in `positions`, and every compliance report, audit filter or '
+        + 'review process that assumed policy tags names the mechanism it actually uses instead.',
+    },
     {
       id: 'platform-timezone-columns-iana-domain-refused',
       surface:
@@ -19091,6 +19121,20 @@ export const RETIRED_KEYS_BY_MAJOR: Readonly<Record<number, readonly string[]>>
     // D2 conversion `permission-allow-restore-purge-removed`, which strips the
     // key from every object grant in `permissions[].objects`.
     'security/ObjectPermission:allowRestore',
+    // #20321 (ADR-0049 enforce-or-remove; graded RETIRE by the maintainer's
+    // criterion for declared-but-unenforced families — does a mainstream platform
+    // have the capability?). `RowLevelSecurityPolicy.tags` promised categorization
+    // and reporting for governance and compliance, and nothing ever read it: the
+    // RLS compiler never consults it, objectui's permission preview renders only
+    // the policy count and its policy editor neither seeds nor reads the key, and
+    // cloud has no reader. No mainstream platform tags a row-level policy. The
+    // policy shape is `strictObject`, but the def is reachable from the
+    // `permission` metadata root, so the route is the `retiredKey()` tombstone
+    // (the `rls.priority` posture one key over): the key stays in the walked shape
+    // as `[RETIRED]`, and authoring it is a tsc error and a parse error carrying
+    // the prescription. D2: `permission-rls-tags-removed`; D3:
+    // `permission-rls-tags-retired`.
+    'security/RowLevelSecurityPolicy:tags',
     // #15679 (stack card 4/6 of #14478) — ruling B. `AccessControlConfig.maxAge` said
     // "CORS preflight cache duration in seconds" in prose and nothing else.
     // ⚠️ This key is deliberately a RENAME and not an `externalVocabulary` marker,