refactor(cli): simplify profile composition and dump paths

- composeProfile keeps layers as bundle/user/overlay+flags segments instead
  of one flat list later re-sliced by index arithmetic; the row index drops
  the group-walk (profile trees are flat patch compositions) and the double
  composition.
- The config dump anchors on the profile's real empty root (written by the
  shared prepareProfile) instead of materializing a temp file, so dump and
  boot compose over the identical base by construction.
- dsh-base drops its patchPath export: the dsh.patch manifest field is the
  one contract; the package carries no runtime API.
- packageDirFromAnchor is paths-probe only (the require.resolve fast path
  duplicated the probe's outcome); basename() replaces hand-rolled path
  splitting; verify-cordis-config stops re-reading bundle manifests in-loop.

packages/bundle/base/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/bundle/base/README.md
-README.md: dd44e825f9a62c8b5e49a6af31c17b242a1927d7
-README.zh.md: 7227345591b5ddf6d27a88038074ed3541b01102
+README.md: 627dddc3808f67a2624e6e5b4d7f71c1617f227a
+README.zh.md: 84f48357d7b66df334d9f78eff64b0c7de3080e1

packages/bundle/base/README.md

@@ -2,7 +2,7 @@
 
 English | [中文](README.zh.md)
 
-The shared dsh core as a profile bundle: [`cordis.patch.yml`](cordis.patch.yml) inserts every base plugin row — model adapters, tools, persistence, policy, settings/credentials, repository Plugins, telemetry — over the empty profile root, as the first layer of every profile's `dsh.plugins` list. Later bundle layers (e.g. [`dsh-web-app`](../web-app/README.md)) and the user's profile `cordis.patch.yml` override these rows by id; a patch replaces a row's whole `config`, so mode-specific values live in mode bundles, not here. The package's TypeScript surface is a single `patchPath` convenience export; the profile composer resolves the patch through the `dsh.patch` manifest field, never through code.
+The shared dsh core as a profile bundle: [`cordis.patch.yml`](cordis.patch.yml) inserts every base plugin row — model adapters, tools, persistence, policy, settings/credentials, repository Plugins, telemetry — over the empty profile root, as the first layer of every profile's `dsh.plugins` list. Later bundle layers (e.g. [`dsh-web-app`](../web-app/README.md)) and the user's profile `cordis.patch.yml` override these rows by id; a patch replaces a row's whole `config`, so mode-specific values live in mode bundles, not here. The package has no runtime API; the profile composer resolves the patch through the `dsh.patch` manifest field, never through code.
 
 The row set and its rationale are documented inline in the patch file; the [generated composition graph](../../../apps/cli/composition.md) renders it.
 

packages/bundle/base/README.zh.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 中文
 
-以 profile 组合包形式交付的共享 dsh 核心：[`cordis.patch.yml`](cordis.patch.yml) 在空的 profile 根之上插入全部基础插件行——模型适配器、工具、持久化、策略、settings／credentials、repository 插件、遥测——作为每个 profile 的 `dsh.plugins` 列表中的第一层。后续的组合包层（例如 [`dsh-web-app`](../web-app/README.md)）和用户 profile 的 `cordis.patch.yml` 按 id 覆盖这些行；patch 会替换目标行的整个 `config`，因此模式专属的值放在各模式组合包中，而不是这里。该包的 TypeScript 表层只有一个便利导出 `patchPath`；profile 组合器通过 manifest（元数据清单）的 `dsh.patch` 字段解析 patch，绝不通过代码。
+以 profile 组合包形式交付的共享 dsh 核心：[`cordis.patch.yml`](cordis.patch.yml) 在空的 profile 根之上插入全部基础插件行——模型适配器、工具、持久化、策略、settings／credentials、repository 插件、遥测——作为每个 profile 的 `dsh.plugins` 列表中的第一层。后续的组合包层（例如 [`dsh-web-app`](../web-app/README.md)）和用户 profile 的 `cordis.patch.yml` 按 id 覆盖这些行；patch 会替换目标行的整个 `config`，因此模式专属的值放在各模式组合包中，而不是这里。该包没有运行时 API；profile 组合器通过 manifest（元数据清单）的 `dsh.patch` 字段解析 patch，绝不通过代码。
 
 行集合及其设计依据以行内注释写在 patch 文件里；[生成的组合图](../../../apps/cli/composition.md)负责渲染它。
 

packages/bundle/base/src/index.ts

@@ -1,14 +1,9 @@
 /**
  * @deepseek-ai/dsh-base — the shared dsh core as a profile bundle. The
- * package's substance is `cordis.patch.yml` (declared by the `dsh.patch`
- * manifest field): every profile's first patch layer, inserting the base
- * plugin rows over the empty profile root. This module only names the patch
- * for consumers that need the path programmatically (the profile composer
- * resolves it through the manifest field, not through this export).
+ * package's substance is `cordis.patch.yml`, declared by the `dsh.patch`
+ * manifest field and resolved by the profile composer through that field;
+ * this module carries no runtime API.
  * @module @deepseek-ai/dsh-base
  */
 
-import { fileURLToPath } from 'node:url'
-
-/** Absolute path of this bundle's profile patch. */
-export const patchPath: string = fileURLToPath(new URL('../cordis.patch.yml', import.meta.url))
+export {}

packages/bundle/base/tests/base.spec.ts

@@ -1,19 +1,21 @@
 /**
- * The bundle's substance is its patch file: the convenience export must point
- * at the real, parseable patch list the `dsh.patch` manifest field declares.
+ * The bundle's substance is its patch file: the `dsh.patch` manifest field
+ * must name a real, parseable patch list.
  */
 
 import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { resolve } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import * as yaml from 'js-yaml'
 import { entryListSchema } from '@cordisjs/plugin-include'
-import { patchPath } from '../src/index.ts'
 
 describe('dsh-base bundle', () => {
-  it('exports the path of a parseable patch list matching the manifest declaration', () => {
-    const manifest = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) as { dsh?: { patch?: string } }
+  it('declares a parseable patch list through the dsh.patch manifest field', () => {
+    const root = fileURLToPath(new URL('..', import.meta.url))
+    const manifest = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8')) as { dsh?: { patch?: string } }
     expect(manifest.dsh?.patch).toBe('./cordis.patch.yml')
-    const parsed = yaml.load(readFileSync(patchPath, 'utf8'), { schema: entryListSchema })
+    const parsed = yaml.load(readFileSync(resolve(root, manifest.dsh!.patch!), 'utf8'), { schema: entryListSchema })
     expect(Array.isArray(parsed)).toBe(true)
     // The base layer is one insert list over the empty profile root.
     const rows = (parsed as { insert?: { id?: string }[] }[]).flatMap(patch => patch.insert ?? [])