hideDelete never reaches NEO backend — delete is UI-only, not enforced server-side

[Gremiger]

Root cause

decisions.json's entity-level hideDelete: true correctly flows through generate-contract.js (lines ~1270, ~1329) into contract.json's frontendContract/backendContract.apiPrediction.crud.<entity>.delete = false, and the generator correctly bakes that into the generated frontend Page component (UI hides/no-ops the delete action).

However, hideDelete never reaches the NEO Headless backend's actual capability flag:

• cli/src/push-to-neo.js's stepPopulateSpec() (~line 562) unconditionally calls populateWindowSpec() in cli/src/neo-writer.js with includeAllMethods: true.
• neo-writer.js:485-487 — upsertEntity's default isDelete value is overridden by the spread at neo-writer.js:513, which forces isDelete: 'Y' on every ETGO_SF_ENTITY row derived from AD metadata because of the includeAllMethods: true flag above.
• Nothing downstream in push-to-neo.js ever reads contract.json's apiPrediction.crud.<entity>.delete per entity to override isDelete accordingly.

Net effect: hideDelete: true only hides delete in the UI. A direct DELETE request against the NEO Headless API (bypassing the frontend) still succeeds server-side — the enforcement mechanism exists (entity.isDelete() is genuinely checked at runtime) but is never wired from the hideDelete decision.

Affected windows

• All 8 windows from ETP-4565: product-category, business-partner-category, asset-group, tax, financial-account, contacts (x2), warehouse
• Earlier precedents that also used entity-level hideDelete: ETP-4464 (tax) and ETP-4512 (userRoles on the user window)

Proposed fix

In cli/src/push-to-neo.js, add a new step between renameEntitiesToContractNames and stepUpdateFieldVisibility that:

1. Reads contract.json's apiPrediction.crud.<entity>.delete per entity.
2. Syncs etgo_sf_entity.isdelete accordingly (Y when true/absent, matching existing default; N when explicitly false).

This is a generic pipeline fix (not per-window). Once landed, push-to-neo must be re-run for all previously-affected windows (tax, user/userRoles, and the 8 ETP-4565 windows) to close the gap in already-deployed tenants.

Jira: ETP-4745