feat(bash): shell tools reject a mismatched executor dialect at load

The seam gains ShellDialect ('bash' | 'powershell' - concrete shells, not
families: zsh or fish would be their own values, never 'bash'); bash-local
declares bash (bash-sandbox inherits), pwsh-local declares powershell, and
both tools throw at load when the mounted executor speaks another dialect -
previously tool-pwsh over bash-local handed PowerShell text to bash -c and
the deployment error surfaced as ordinary nonzero exits. Pinned by mismatch
tests on both tools; the parity note records the contract (both languages).

Also from the review round: the tool-bash README's managed-environment
section becomes a summary linking the owning dsh-bash-env contract (the
duplicated prose carried a stale owner in its example import), the
pwshOnly JSDoc drops the stale 'on PATH' phrasing, and the task-tools
contract comment in the two pwsh compositions is indented into its block.

examples/acp-agent/tests/pwsh.cordis.snapshot.yml

@@ -27,7 +27,8 @@
     workspaceContext: false
     skills:
       enabled: false
-# task_output/task_kill stay mounted so background pwsh runs are readable and killable.
+    # task_output/task_kill stay mounted (the bundle's toolTasks default) so
+    # background pwsh runs are readable and killable.
     goals: false
     # The pwsh tool replaces the bundle's bash tool in this composition.
     toolBash: false

examples/acp-agent/tests/pwsh.cordis.yml

@@ -26,7 +26,8 @@
     workspaceContext: false
     skills:
       enabled: false
-# task_output/task_kill stay mounted so background pwsh runs are readable and killable.
+    # task_output/task_kill stay mounted (the bundle's toolTasks default) so
+    # background pwsh runs are readable and killable.
     goals: false
     # The pwsh tool replaces the bundle's bash tool in this composition.
     toolBash: false