fix review findings: harden the app bins + built-bin smokes, arch-exception doc, snapshot fixture-guard

BLOCKER — the published lib/bin.js (stdio + acp) was exercised only via tsx
(demo:* / the src/bin.ts smokes); the built artifact under plain `node` was
unguarded. Root-cause on the BUILT bin:
  1. Settle race: boot() returned once loader.create() registered the include
     ENTRY, but the include loads its child plugins asynchronously — so boot()
     (and main()) resolved while the app plugins (stdin reader, agent loop, ACP
     bridge) were still mounting. A CLI with no attached handles yet exits 0
     silently, and a load error surfaces as an unhandled rejection AFTER boot.
     Fix: `await ctx.loader.await()` after create() — settle the whole tree.
  2. Config-path robustness: hand the include the config's ABSOLUTE file:// URL
     so resolution never depends on ctx.baseUrl / can never fall back to cwd.
Both bins fixed identically. NOTE: the cordis Loader resolves a config's bare
plugin specifiers via its internal module loader, active only under
`node --expose-internals`; the bin cannot add a node flag itself, so this is
documented in the bin JSDoc + both package READMEs (the demos already comply).
The repo `examples/*/cordis.yml` are tsx-only artifacts (workspace plugins
resolve through the tsconfig paths map, not node_modules), so they are not a
valid plain-node bin target — the smokes use a real-install-shaped temp dir.

Fail loud on a load failure: boot() previously exited 0 SILENTLY when a config
path's directory does not exist — the include plugin fails to IMPORT, the cordis
Loader catches+LOGS it and leaves the entry with no fiber (no rejection), and
`loader.await()` does not rethrow (EntryTree.await uses Promise.allSettled). Fix:
boot() now calls assertEntriesLoaded(ctx) after the tree settles and throws on
any entry with no fiber, so a typo'd config dir exits non-zero with a clear
message. main() also installs an unhandledRejection guard (installFailLoud) that
replaces Node's stack dump with a single labelled stderr line for the
companion case (a missing config FILE in a real dir, whose include-init throw
surfaces as a rejection Node already exits non-zero on). Regression tests added
to both built-bin smokes (missing dir + missing file → non-zero exit + stderr);
verified the missing-dir test fails on the pre-fix bin.

Built-bin smokes (the reviewer's ask): packages/ui/{stdio,acp}-agent/tests/
built-bin.e2e.ts run the REAL lib/bin.js under `node` (NOT tsx) in a temp
consumer dir, asserting the stdio echo round-trip / the acp initialize response
+ stdout purity, plus the fail-loud cases above. They build-gate (skip if lib/
absent) and run in a new ci.yml step after the build.

Issue 2 — packages/README.md + docs/architecture.md said "plugins depend on
interfaces, never on the concrete loop", but dsh-agent-core imports the concrete
dsh-agent-loop. Scope the rule to EXTENSION plugins and carve out the sanctioned
COMPOSITION/bundle exception (dsh-agent-core composes the concrete spine); note
it in the implemented RFC too.

Issue 3 — examples/acp-agent/tests/acp.snapshot.ts fixture-guard claimed
no-model scenarios need no session.jsonl, but runScenario() always boots
llm-replay with the session.jsonl path and loadReplayScript() throws when it is
absent. Require session.jsonl for ALL scenarios (no-model ones ship a
header-only fixture) and rewrite the comment to match reality.

examples/acp-agent/tests/acp.snapshot.ts

@@ -134,19 +134,21 @@ describe('snapshot fixtures', () => {
   })
 
   it('every registered scenario has its required fixture files', async () => {
-    // Required files are per-KIND. Every scenario has an input script and an
-    // stdout golden. Only model scenarios persist a session log, so only they
-    // require `session.jsonl` (the replay source AND expected-log artifact);
-    // a no-model scenario boots `llm-replay` with an empty script and needs no
-    // session fixture. Authored scenarios additionally ship the
-    // `replay.override.json` sidecar that drives their model behavior.
+    // Every scenario has an input script and an stdout golden. EVERY scenario
+    // also needs `session.jsonl`: the harness boots `llm-replay` with that path
+    // as the replay source for ALL scenarios (acp.snapshot.ts passes
+    // `fixtureFile: <dir>/session.jsonl` unconditionally), and `loadReplayScript`
+    // throws "fixture not found" when it is absent and no override replaces it.
+    // A no-model scenario ships a header-only `session.jsonl` (it derives to an
+    // empty script — no model call is made); a model scenario's fixture also
+    // doubles as the expected-log artifact the run is diffed against. An authored
+    // (non-`recorded`) model scenario additionally ships a `replay.override.json`
+    // sidecar for the throw/hang cases a derived script cannot express.
     for (const { name, hasModelTurn, recorded } of SCENARIOS) {
       const dir = join(SNAPSHOTS_DIR, name)
       expect(existsSync(join(dir, 'input.json')), `${name}/input.json`).toBe(true)
       expect(existsSync(join(dir, 'stdout.golden.jsonl')), `${name}/stdout.golden.jsonl`).toBe(true)
-      if (hasModelTurn) {
-        expect(existsSync(join(dir, 'session.jsonl')), `${name}/session.jsonl`).toBe(true)
-      }
+      expect(existsSync(join(dir, 'session.jsonl')), `${name}/session.jsonl`).toBe(true)
       if (hasModelTurn && !recorded) {
         expect(existsSync(join(dir, 'replay.override.json')), `${name}/replay.override.json`).toBe(true)
       }