feat(adapters): add DeepSeek Harness (dsh) plugin source adapter

[bobleer]

Summary

Adds a runtime-free sibling adapter that statically projects DeepSeek Harness (dsh) managed packages into BitFun's plugin-source model, following the existing OpenCode static-preview boundary.

dsh packages may declare a bundle (dsh.bundle.patch → a Cordis patch list), a profile (dsh.profile.bundles → an ordered bundle-layer list), or both roles.

What this does

• Adds bitfun-dsh-adapter and PluginSourceKind::DeepSeekHarnessCompatible.
• Routes adapter: "dsh_compatible" packages through Product Assembly while preserving the existing OpenCode activation policy.
• Projects:
  • the explicitly declared, package-relative bundle patch;
  • top-level Cordis patch operations, inserted entries, and nested group: true / config entries;
  • ordered profile bundle references, including repeated layers with distinct stable identities;
  • packages declaring both bundle and profile roles.
• Preserves package version/content-hash identity on invalid projections and emits typed diagnostics for unsupported or unprojectable content.
• Rejects invalid DSH projections before activation persistence; the adapter also rejects them defensively when loading activated content.
• Requires dsh.bundle.patch as the DSH manifest contract does, normalizes . / .. package-relative segments, and blocks package escapes.
• Accepts the DSH YAML dialect used by current bundles, including !!js tagged scalars.

All projections remain ProjectionOnly. This adapter does not execute Cordis plugins, install npm packages, or invoke a local dsh CLI. Cordis rows can mount services that later register model-facing tools inside dsh, but static row metadata is not an executable BitFun provider candidate, so this adapter exposes no BitFun dispatch targets.

Verification

• cargo test --locked -p bitfun-dsh-adapter --test dsh_source_adapter — 15 passed
• cargo test --locked -p bitfun-core --no-default-features --features plugin-runtime --lib plugin_runtime::tests — 9 passed
• cargo test --locked -p bitfun-runtime-ports --no-default-features --features plugin-runtime --test plugin_runtime_contracts — 15 passed
• cargo clippy --locked -p bitfun-dsh-adapter --all-targets --no-deps -- -D warnings
• pnpm run check:core-boundaries:test — 118 passed
• pnpm run check:core-boundaries
• pnpm run check:repo-hygiene
• pnpm install --frozen-lockfile
• pnpm run desktop:dev — Vite returned HTTP 200 and target/debug/bitfun-desktop started
• dsh web --port 3081 from the current dsh repository — returned HTTP 200

Remote scenarios

Exercised locally for managed-package discovery, static projection, activation gating, and product assembly. Remote workspace, Remote Control, Peer Device Mode, and Detached Dispatch were not exercised; this change adds no remote I/O, host execution, dialog, or transport path, so the local checks are not evidence for those scenarios.