fix(spec): write the warn-once dedupe separator as an escape, not a raw NUL byte

`check:nul-bytes` (#3127) caught two literal U+0000 bytes in the
`warnDeprecatedAliases` key. A raw NUL makes ripgrep treat the whole file as
binary and silently return zero matches, so `stack.zod.ts` would have dropped
out of code search and every grep-based lint. Written as the unicode escape it
is byte-identical at runtime.

Same separator in `deprecated-aliases.ts`'s dedupe key, with a note on why it
must stay an escape, and regenerate the spec API-surface snapshot for the four
new exports (0 breaking, 4 added).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JqC9ckaLbmhmytt65Gxi96

Author: claude

packages/spec/api-surface.json

@@ -1,5 +1,6 @@
 {
   ".": [
+    "ACTION_TARGET_EXECUTE_CONFLICT (const)",
     "ADMIN_FULL_ACCESS (const)",
     "ALL_CONVERSIONS (const)",
     "AUDIENCE_ANCHOR_POSITIONS (const)",
@@ -35,6 +36,7 @@
     "DatasourceMappingRule (type)",
     "DatasourceMappingRuleSchema (const)",
     "DefineStackOptions (interface)",
+    "DeprecatedAliasFinding (interface)",
     "EVERYONE_POSITION (const)",
     "EvalUser (type)",
     "EvalUserInput (type)",
@@ -144,11 +146,13 @@
     "expandViewContainerWithDiagnostics (function)",
     "expression (function)",
     "findClosestMatches (function)",
+    "formatDeprecatedAliasFinding (function)",
     "formatSuggestion (function)",
     "formatZodError (function)",
     "formatZodIssue (function)",
     "isAggregatedViewContainer (function)",
     "isKnownPlatformCapability (function)",
+    "lintDeprecatedAliases (function)",
     "mapMembershipRole (function)",
     "normalizeMetadataCollection (function)",
     "normalizePluginMetadata (function)",

packages/spec/src/shared/deprecated-aliases.ts

@@ -112,7 +112,10 @@ export function lintDeprecatedAliases(stack: AnyRec): DeprecatedAliasFinding[] {
     if (target === execute) return;
 
     const actionName = typeof action.name === 'string' && action.name ? action.name : '(unnamed)';
-    const dedupeKey = `${actionName} ${describeHandler(target)} ${describeHandler(execute)}`;
+    // `\u0000` written as an escape, never as a raw byte: a literal NUL makes
+    // ripgrep treat the whole file as binary and silently drop it from every
+    // grep-based lint (`scripts/check-nul-bytes.mjs` enforces this).
+    const dedupeKey = `${actionName}\u0000${describeHandler(target)}\u0000${describeHandler(execute)}`;
     if (seen.has(dedupeKey)) return;
     seen.add(dedupeKey);
 

packages/spec/src/stack.zod.ts

@@ -1061,7 +1061,7 @@ const warnedAliasFindings = new Set<string>();
  */
 function warnDeprecatedAliases(normalized: Record<string, unknown>): void {
   for (const finding of lintDeprecatedAliases(normalized)) {
-    const key = `${finding.rule}
+    const key = `${finding.rule}\u0000${finding.where}\u0000${finding.message}`;
     if (warnedAliasFindings.has(key)) continue;
     warnedAliasFindings.add(key);
     console.warn(`defineStack: ${formatDeprecatedAliasFinding(finding)}`);