refactor(preset): gate tool-pwsh by platform alongside tool-bash

The web-app overlay now disables the host tool-pwsh row too, and the shipped
presets (standard/code/cordis) declare both shell tool rows with inverted
platform gates — tool-bash on POSIX, tool-pwsh on win32 — so the preset layer
exposes exactly one shell tool per host and a preset can drop or replace the
shell tool on either platform. windows-shell.spec pins both preset gates and
both host tool rows disabled in the web composition; the loader and Windows
pwsh notes are updated in place.

apps/cli/config/agent-presets/code/agent.cordis.yml

@@ -45,14 +45,21 @@
 # publish `DSH_WEB_URL`/`DSH_WEB_MODE`, and a host row that injects a service is
 # the criterion for host-plane ownership — injection resolves before any session
 # exists, so there is no agent to key by. Behind a preset realm those variables
-# never reached the model's shell at all. `tool-bash` consumes the host registry
-# from here; the executor behind it (`bash-sandbox`) is host-plane too, where the
-# sandbox policy owns it.
+# never reached the model's shell at all. Both shell tools consume the host
+# registry from here; the executors behind them (`bash-sandbox`/`pwsh-sandbox`)
+# are host-plane too, where the sandbox policy owns them. The web-app overlay
+# disables the host shell-tool rows, so exactly one of these rows mounts per
+# host — `tool-bash` on POSIX, `tool-pwsh` on win32.
 - id: tool-bash
   name: '@deepseek-ai/dsh-tool-bash'
   # POSIX-only: the base composition swaps the bash stack for the pwsh stack on win32.
   disabled: !!js process.platform === 'win32'
 
+- id: tool-pwsh
+  name: '@deepseek-ai/dsh-tool-pwsh'
+  # win32-only twin of tool-bash: bash has no Windows runner.
+  disabled: !!js process.platform !== 'win32'
+
 # ── filesystem ──────────────────────────────────────────────────────────────
 
 # Both register into the host `tools` registry and provide nothing, so

apps/cli/config/agent-presets/cordis/agent.cordis.yml

@@ -39,14 +39,21 @@
 # publish `DSH_WEB_URL`/`DSH_WEB_MODE`, and a host row that injects a service is
 # the criterion for host-plane ownership — injection resolves before any session
 # exists, so there is no agent to key by. Behind a preset realm those variables
-# never reached the model's shell at all. `tool-bash` consumes the host registry
-# from here; the executor behind it (`bash-sandbox`) is host-plane too, where the
-# sandbox policy owns it.
+# never reached the model's shell at all. Both shell tools consume the host
+# registry from here; the executors behind them (`bash-sandbox`/`pwsh-sandbox`)
+# are host-plane too, where the sandbox policy owns them. The web-app overlay
+# disables the host shell-tool rows, so exactly one of these rows mounts per
+# host — `tool-bash` on POSIX, `tool-pwsh` on win32.
 - id: tool-bash
   name: '@deepseek-ai/dsh-tool-bash'
   # POSIX-only: the base composition swaps the bash stack for the pwsh stack on win32.
   disabled: !!js process.platform === 'win32'
 
+- id: tool-pwsh
+  name: '@deepseek-ai/dsh-tool-pwsh'
+  # win32-only twin of tool-bash: bash has no Windows runner.
+  disabled: !!js process.platform !== 'win32'
+
 # ── filesystem ──────────────────────────────────────────────────────────────
 
 # Both register into the host `tools` registry and provide nothing, so

apps/cli/config/agent-presets/standard/agent.cordis.yml

@@ -38,14 +38,21 @@
 # publish `DSH_WEB_URL`/`DSH_WEB_MODE`, and a host row that injects a service is
 # the criterion for host-plane ownership — injection resolves before any session
 # exists, so there is no agent to key by. Behind a preset realm those variables
-# never reached the model's shell at all. `tool-bash` consumes the host registry
-# from here; the executor behind it (`bash-sandbox`) is host-plane too, where the
-# sandbox policy owns it.
+# never reached the model's shell at all. Both shell tools consume the host
+# registry from here; the executors behind them (`bash-sandbox`/`pwsh-sandbox`)
+# are host-plane too, where the sandbox policy owns them. The web-app overlay
+# disables the host shell-tool rows, so exactly one of these rows mounts per
+# host — `tool-bash` on POSIX, `tool-pwsh` on win32.
 - id: tool-bash
   name: '@deepseek-ai/dsh-tool-bash'
   # POSIX-only: the base composition swaps the bash stack for the pwsh stack on win32.
   disabled: !!js process.platform === 'win32'
 
+- id: tool-pwsh
+  name: '@deepseek-ai/dsh-tool-pwsh'
+  # win32-only twin of tool-bash: bash has no Windows runner.
+  disabled: !!js process.platform !== 'win32'
+
 # ── filesystem ──────────────────────────────────────────────────────────────
 
 # Both register into the host `tools` registry and provide nothing, so