fix(web): align core profile with RL prompt

apps/cli/config/core-web.cordis.yml

@@ -1,6 +1,26 @@
-# Opt-in two-tool profile over the shipped Web composition. The default native
-# model surface is exactly persistent `bash` plus `str_replace_editor`; the
-# Web host, browser shell, workspace, persistence, and permission stack remain.
+# Opt-in Web shell for the RL core agent contract. The model receives exactly
+# the configured persona plus the native `bash` and `str_replace_editor`
+# schemas; the Web host, browser shell, persistence, and permission stack stay.
+
+# Match the Claude SWE-compatible RL core prompt. The launcher-owned Web
+# orientation is a separate plugin so disabling it removes both its prompt
+# sections without a path-specific launcher branch. Workspace instructions are
+# model-visible user context rather than a system section, but RL core disables
+# them as part of the same prompt contract.
+- id: system-prompt
+  config:
+    includeHarnessIdentity: false
+    persona: !!js process.env.DSH_SYSTEM_PROMPT ?? 'You are a helpful software engineer assistant.'
+
+- id: web-runtime-context
+  disabled: true
+
+- id: workspace-context
+  disabled: true
+
+- id: tools
+  config:
+    mode: native
 
 # Disable every model-facing consumer in the base/Web tree. plan-mode owns the
 # always-registered exit_plan_mode tool even while the session is not planning.

apps/cli/config/web.cordis.yml

@@ -46,6 +46,12 @@
 # `dshClient` rows are the browser roster the modules node half scans into
 # window.__DSH_BOOT__; the modules row is simultaneously a host row.
 - insert:
+    # Launcher-provided builtin: owns Web GUI orientation in the model prompt
+    # and the matching managed Bash variables. Profiles with a complete prompt
+    # contract disable this row instead of relying on launcher special cases.
+    - id: web-runtime-context
+      name: cordis:web-runtime-context
+
     - id: session-projection
       name: '@deepseek-ai/dsh-session-projection'