A reference to an object that actions can be evaluated for. Exactly one
variant must be set per entry; the schema enforces this via @oneOf.
New object kinds (e.g. patch, installed software) are added by introducing
new variants — no enum to maintain, no breaking changes for existing callers.