ADR-0089 D3a: flip `.strict()` on view/page schemas so mis-layered visibility keys are loud errors

[os-zhuang]

Follow-up to #2642 / #2900 (ADR-0089). D1 (canonical visibleWhen) + D2 (deprecated visibleOn/visibility aliases normalized at parse) have landed. This tracks D3a.

Goal

Per ADR-0049 (enforce-or-remove) and ADR-0078 (no-silently-inert), a mis-layered or stale visibility key must be a loud parse error, not a silent strip. Tighten the relevant object schemas with .strict() so e.g. a raw visibleOn surviving past the deprecation window, or a visibleWhen on a schema with no visibility semantics, fails validation.

Why it's staged separately

.strict() on FormFieldSchema / FormSectionSchema / PageComponentSchema rejects every unknown key, not just visibility ones — a large blast radius. The ADR requires sweeping the monorepo + example apps first, then flipping strict. That sweep is bigger than the alias mechanism and risky to land alongside it under parallel-agent development.

Tasks

• Sweep packages/ + examples/ (and platform metadata) for any keys these schemas currently strip silently; fix or file them.
• Add .strict() (or a targeted unknown-key guard with UNKNOWN_KEY_GUIDANCE tombstones) to the view form + page component schemas.
• Confirm the deprecated visibleOn/visibility aliases still parse (they are declared keys, so strict must keep accepting them until removal).
• Ensure the rejection message points authors at visibleWhen.

References

• ADR-0089 D3a (docs/adr/0089-unify-visibility-predicate-naming.md)
• Precedent: object.zod.ts UNKNOWN_KEY_GUIDANCE
• Parent: Implement ADR-0089: unify conditional-visibility predicate under visibleWhen #2642