refactor(cmdline)!: an app's entrypoint provides values its rows read

Replaces the patch round trip. An app's entrypoint resolves the command
line into a service, and the rows it configures read that service from
their own config — port: !!js ctx.get('webStartup')?.port ?? 3080 — so the
resolved value beats the value written beside it and nothing is written
back into a row or handed to the launcher.

A bundle names the entrypoint row in its manifest (dsh.bundle.entrypoint),
which is what lets the boot mount in two passes: entrypoints alone, then
the whole composition. That ordering is required, not cosmetic — a row's
config expressions are evaluated when the include applies the row, and a
strict ctx.get only answers for a service whose providing fiber is already
active.

What this removes: ctx.appPatches and the launcher-owned patch layer, the
disable/re-enable recycle and its in-flight-mount barrier, overrideConfig,
and the reload hazard they existed for. A live config edit now re-applies
the second pass against services that are still up, so a served port
survives by construction.

What it adds: ctx.appReady, because Loader settlement no longer means the
app is up — a row mounted in the second pass can observe a settled tree
while that pass is still running, or already rolling back. The web URL line
waits for it, so a boot that fails in the second pass announces nothing.

packages/bundle/web-app/tests/web-app.spec.ts

@@ -131,6 +131,38 @@ describe('web-app runtime glue', () => {
     await ctx.fiber.dispose()
   })
 
+  it('waits for the launcher readiness the phased boot provides, and stays quiet when that boot failed', async () => {
+    stageDist()
+    // The launcher-provided readiness wins over Loader settlement: a phased
+    // boot settles the Loader between phases, long before the app is up.
+    const ready = new Context()
+    ready.provide('httpServer', fakeHttpServer().server)
+    ready.provide('loader', { await: () => Promise.resolve() } as never)
+    let announce: () => void
+    ready.provide('appReady', new Promise<void>((resolve) => { announce = resolve }))
+    const log = vi.spyOn(console, 'log').mockImplementation(() => {})
+    apply(ready, new Config({ mode: 'production', printUrl: true, surfaceContext: true, lanAddresses: [] }))
+    await new Promise(resolve => setTimeout(resolve, 0))
+    expect(log).not.toHaveBeenCalled()
+    announce!()
+    await new Promise(resolve => setTimeout(resolve, 0))
+    expect(log).toHaveBeenCalledWith('dsh web: http://127.0.0.1:4567')
+    await ready.fiber.dispose()
+
+    // A boot that failed announces nothing: the launcher reports it, and a URL
+    // for a process that is about to exit would only mislead.
+    log.mockClear()
+    const failed = new Context()
+    failed.provide('httpServer', fakeHttpServer().server)
+    const rejection = Promise.reject(new Error('boot failed'))
+    rejection.catch(() => {})
+    failed.provide('appReady', rejection)
+    apply(failed, new Config({ mode: 'production', printUrl: true, surfaceContext: true, lanAddresses: [] }))
+    await new Promise(resolve => setTimeout(resolve, 0))
+    expect(log).not.toHaveBeenCalled()
+    await failed.fiber.dispose()
+  })
+
   it('defers the URL line until Loader settlement and drops it when the server is gone', async () => {
     stageDist()
     // Settlement path: the line waits for loader.await() so supervisors can