plugin-auth, plugin-sharing: the last-admin guard, self-registration, default-organization and sharing-rule readers read the security catalog and the activation ledger (#15204 stage 2b) - #22745