docs(19.6.1-04): state Administrators outranking on the D-14 seam

- cabana, not the contributor, applies guardOutranked before a contributed Run
- A contribution to summercms.cabana.users is 403 user.outranked when the target outranks the caller

Co-authored-by: Cursor <cursoragent@cursor.com>

modules/pact/capabilities.go

@@ -387,8 +387,12 @@ type HasAdminRecordActions interface {
 // through the target's FormExtendQuery scope inside the action's transaction
 // and hands it to Run, which reads that transaction with
 // cabana.TxFromContext. An administrator needs the target controller's
-// RequiredPermissions and the action's own Permissions. A record action
-// carries no input beyond the record.
+// RequiredPermissions and the action's own Permissions. When Controller is
+// the admin's Administrators screen (summercms.cabana.users), cabana runs
+// its outranking check inside the action transaction before the
+// contributor's Run; a non-superuser whose grants do not cover the
+// target's effective grants gets 403 with backend::lang.user.outranked and
+// Run is not called. A record action carries no input beyond the record.
 //
 // The admin compiles extensions at boot, only when it is active (some
 // plugin registers admin controllers). An unknown controller ID, a target