refactor(preset): gate tool-pwsh by platform alongside tool-bash

The web-app overlay now disables the host tool-pwsh row too, and the shipped
presets (standard/code/cordis) declare both shell tool rows with inverted
platform gates — tool-bash on POSIX, tool-pwsh on win32 — so the preset layer
exposes exactly one shell tool per host and a preset can drop or replace the
shell tool on either platform. windows-shell.spec pins both preset gates and
both host tool rows disabled in the web composition; the loader and Windows
pwsh notes are updated in place.

packages/bundle/web-app/cordis.patch.yml

@@ -253,10 +253,18 @@
 # the criterion for host-plane ownership — injection resolves before any session
 # exists, so there is no agent to key by. Behind a preset realm those variables
 # would never reach the model's shell at all.
+#
+# Both shell TOOL rows move behind presets on every platform: the executors
+# (`bash-sandbox`/`pwsh-sandbox`) stay host-plane with their platform gates in
+# the base patch, while each session's preset declares the shell tool its agent
+# sees and gates it by platform — so the host tool rows are disabled here.
 
 - id: tool-bash
   disabled: true
 
+- id: tool-pwsh
+  disabled: true
+
 # The background-task REGISTRY stays on the host plane; only the model-facing
 # `task_*` controls move. Its producers — `tool-bash` here, `tool-pty` and a
 # non-continuable `tool-subagent` elsewhere — are preset rows that resolve it