feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles

Profile bundles are npm packages declaring dsh.patch in their manifest:
dsh-base carries the former base.cordis.yml rows as one insert over the empty
profile root; dsh-web-app carries the web overlay plus a runtime glue plugin
owning what used to be launcher code (frontend dist resolution via
frontend-static, the web-surface prompt section, bash runtime variables, the
readiness-gated URL line); dsh-headless carries the one-shot runner driving a
task turn through the in-process API carrier under the launcher-provided
ctx.headlessIo seam.

tsconfig.base.json

@@ -93,6 +93,7 @@
         "./packages/spill/*/src/invariant.ts",
         "./packages/timeout/*/src/invariant.ts",
         "./packages/todo/*/src/invariant.ts",
+        "./packages/bundle/*/src/invariant.ts",
         "./packages/cordis/*/src/invariant.ts",
         "./packages/sandbox/*/src/invariant.ts",
         "./packages/hooks/*/src/invariant.ts",
@@ -191,6 +192,7 @@
         "./packages/spill/*/src",
         "./packages/timeout/*/src",
         "./packages/todo/*/src",
+        "./packages/bundle/*/src",
         "./packages/cordis/*/src",
         "./packages/sandbox/*/src",
         "./packages/hooks/*/src",