refactor(cli): simplify profile composition and dump paths

- composeProfile keeps layers as bundle/user/overlay+flags segments instead
  of one flat list later re-sliced by index arithmetic; the row index drops
  the group-walk (profile trees are flat patch compositions) and the double
  composition.
- The config dump anchors on the profile's real empty root (written by the
  shared prepareProfile) instead of materializing a temp file, so dump and
  boot compose over the identical base by construction.
- dsh-base drops its patchPath export: the dsh.patch manifest field is the
  one contract; the package carries no runtime API.
- packageDirFromAnchor is paths-probe only (the require.resolve fast path
  duplicated the probe's outcome); basename() replaces hand-rolled path
  splitting; verify-cordis-config stops re-reading bundle manifests in-loop.

packages/bundle/base/tests/base.spec.ts

@@ -1,19 +1,21 @@
 /**
- * The bundle's substance is its patch file: the convenience export must point
- * at the real, parseable patch list the `dsh.patch` manifest field declares.
+ * The bundle's substance is its patch file: the `dsh.patch` manifest field
+ * must name a real, parseable patch list.
  */
 
 import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { resolve } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import * as yaml from 'js-yaml'
 import { entryListSchema } from '@cordisjs/plugin-include'
-import { patchPath } from '../src/index.ts'
 
 describe('dsh-base bundle', () => {
-  it('exports the path of a parseable patch list matching the manifest declaration', () => {
-    const manifest = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) as { dsh?: { patch?: string } }
+  it('declares a parseable patch list through the dsh.patch manifest field', () => {
+    const root = fileURLToPath(new URL('..', import.meta.url))
+    const manifest = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8')) as { dsh?: { patch?: string } }
     expect(manifest.dsh?.patch).toBe('./cordis.patch.yml')
-    const parsed = yaml.load(readFileSync(patchPath, 'utf8'), { schema: entryListSchema })
+    const parsed = yaml.load(readFileSync(resolve(root, manifest.dsh!.patch!), 'utf8'), { schema: entryListSchema })
     expect(Array.isArray(parsed)).toBe(true)
     // The base layer is one insert list over the empty profile root.
     const rows = (parsed as { insert?: { id?: string }[] }[]).flatMap(patch => patch.insert ?? [])