fix(plating-perms): deploy-time cascade fixes from entech I3

5 fixes discovered during the live deploy to entech LXC 111:

1. pre-migrate.py to rename old configurator's 'Shop Manager' group BEFORE
   new core 'Shop Manager v2' XML loads (cross-module name collision on
   res_groups_name_uniq).

2. res_company_views.xml: dropped ref() inside <field domain=> attribute
   (Odoo 19 view validator interprets it as a field name).

3. sale_order_views.xml: replaced 3 separate xpaths for amount_total /
   amount_untaxed / amount_tax with a single xpath on tax_totals widget
   (Odoo 19 sale.view_order_form uses one widget instead of separate fields).

4. fp_cert_security.xml: certificate_type field, not cert_type. FAIR is a
   separate model so the rule only restricts cert_type='nadcap_cert' now.

5. fp_certificate_views.xml + fp_capa_views.xml + fp_customer_spec_views.xml:
   stripped user_has_groups() from invisible= / readonly= attrs (Odoo 19
   view validator interprets as field name). Model-layer ACLs and ir.rules
   already enforce the same restrictions.

Also fixed res.groups.users -> user_ids in fp_migration.py (Odoo 19 rename,
caught when manually invoking _fp_notify_owners post-deploy).

CLAUDE.md updated with 4 new rules (13e cross-module name collisions,
13f ref() in domain, 13g tax_totals widget, 13h user_has_groups in attrs).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fusion_plating/fusion_plating/models/fp_migration.py

@@ -101,7 +101,7 @@ class FpMigrationPreview(models.Model):
         owner_grp = self.env.ref('fusion_plating.group_fp_owner', raise_if_not_found=False)
         if not owner_grp:
             return
-        owners = owner_grp.users.filtered(lambda u: u.active and not u.share)
+        owners = owner_grp.user_ids.filtered(lambda u: u.active and not u.share)
         if not owners:
             _logger.warning('Fusion Plating migration preview %s: no Owner users to notify', self.id)
             return
@@ -228,7 +228,7 @@ class FpMigrationPreview(models.Model):
             safe_to_unlink = []
             skipped = []
             for old_group in self.env['res.groups'].browse(old_group_ids).exists():
-                active_users = old_group.users.filtered(lambda u: u.active and not u.share)
+                active_users = old_group.user_ids.filtered(lambda u: u.active and not u.share)
                 if active_users:
                     skipped.append((old_group.name, active_users.mapped('login')))
                 else: