feat(headless): boot dsh -p from the shared composition; retire dsh-host-runtime

dsh -p now runs AppCLIEntry over the same cordis.yml as dsh web — one
composition, no disabled rows, no layer marks. The only surface difference
is port 0 (parallel runs never collide), and the printed URL opens the live
headless session in a browser while it runs. The model face gains what web
already had (ask_user_question, workspace context, model titles) per the
unification ruling. InProcessApiClient now wraps toFetchHandler(ctx.apiProxy)
directly, so bootHost/startHost lose their last consumer and the
dsh-host-runtime package retires; its api-proxy behavior specs move to
dsh-host-apiproxy where the implementation lives.

pnpm-lock.yaml

@@ -104,9 +104,6 @@ importers:
       '@cordisjs/plugin-loader':
         specifier: workspace:*
         version: link:../../vendor/loader
-      '@cordisjs/plugin-logger-console':
-        specifier: workspace:*
-        version: link:../../vendor/logger-console
       '@cordisjs/plugin-timer':
         specifier: workspace:*
         version: link:../../vendor/timer