refactor(bundle): fold the Windows shell platform layer into the base rows

Entry \disabled\ interpolation makes the launcher's separate platform layer
unnecessary: the base bundle's cordis.patch.yml now gates both shell stacks
on its own rows — bash-sandbox/tool-bash disable on win32, and their twins
pwsh-sandbox/tool-pwsh mount only there with the inverted expression — so
exactly one shell stack mounts per host from one shared patch file.

windows.cordis.patch.yml and the launcher's windows-shell.ts injection (boot,
live recomposition, config dumps) are deleted, with the workspace-constraints
entry and the dsh-base exports/files entries following. The windows-shell spec
pins the effective per-platform roster through the real bundle layers, and
base.spec pins the four symmetric gates. The superseded active notes are
updated and cross-linked; the loader note records the fold itself.

packages/bundle/base/cordis.patch.yml

@@ -170,11 +170,22 @@
         mode: !!js process.env.DSH_PERMISSION_MODE ?? 'workspace-write'
         workspaceRoot: !!js process.cwd()
 
+    # POSIX shell executor and its win32 twin: bash has no Windows runner, so
+    # each row gates itself on platform and exactly one shell stack mounts per
+    # host (both executors register the same 'bash' service).
     - id: bash-sandbox
       name: '@deepseek-ai/dsh-bash-sandbox'
+      disabled: !!js process.platform === 'win32'
       config:
         timeoutMs: 60000
 
+    # The confined PowerShell executor, mounted on win32 only. Its config keeps
+    # the schema defaults (a 120s timeout); the 60s pin above is the bash
+    # executor's own knob, not a shared shell policy.
+    - id: pwsh-sandbox
+      name: '@deepseek-ai/dsh-pwsh-sandbox'
+      disabled: !!js process.platform !== 'win32'
+
     - id: approval
       name: '@deepseek-ai/dsh-user-approval'
       config:
@@ -197,8 +208,14 @@
     - id: bash-env
       name: '@deepseek-ai/dsh-bash-env'
 
+    # The dialect tools gate with their executors: one shell tool per host.
     - id: tool-bash
       name: '@deepseek-ai/dsh-tool-bash'
+      disabled: !!js process.platform === 'win32'
+
+    - id: tool-pwsh
+      name: '@deepseek-ai/dsh-tool-pwsh'
+      disabled: !!js process.platform !== 'win32'
 
     - id: tool-tasks
       name: '@deepseek-ai/dsh-tool-tasks'