docs(app-boot): fix review findings — exit-semantics precision, dep row, composition wording

The module/README prose claimed both guard-covered failure classes
would otherwise exit 0; only the failed-IMPORT class does (an init
throw already exits non-zero via Node's default handler — the guard
contributes the labelled line and the guaranteed exit(1), as its own
JSDoc says). The dependency-graph row now says loader/include (include
is a peer: boot() names it by entry string, so the installed consumer
provides it). The bins are self-executing compositions, not main()
wrappers.

packages/ui/app-boot/src/index.ts

@@ -3,22 +3,24 @@
  * the gitignored `.env`, install the fail-loud Loader guards, resolve the
  * config path (snapshot-aware), and drive the cordis Loader against a leaf
  * `cordis.yml` until the whole tree has settled. Each bin stays a thin
- * self-executing `main()` over these helpers, parameterized by its diagnostic
- * prefix; the loader-failure lore lives here, once, under the per-file
- * coverage gate.
+ * self-executing composition over these helpers, parameterized by its
+ * diagnostic prefix; the loader-failure lore lives here, once, under the
+ * per-file coverage gate.
  *
- * Two failure classes the guards close, both of which would otherwise exit 0
- * with a usable config typo reported only as a log line:
+ * Two failure classes the guards handle:
  *
  * - `loader.await()` does NOT rethrow a load error (`EntryTree.await()` uses
  *   `Promise.allSettled`, which swallows rejections). A plugin whose
  *   `[Service.init]` throws surfaces as an unhandled rejection AFTER `boot()`
- *   resolves — {@link installFailLoud} turns that into one labelled stderr
- *   line and a guaranteed non-zero exit.
+ *   resolves — Node's default handler already exits non-zero, and
+ *   {@link installFailLoud} replaces the noisy dump with one labelled stderr
+ *   line and a guaranteed `exit(1)`.
  * - A plugin module that fails to IMPORT is caught and only LOGGED by the
  *   cordis Loader (`entry._init`), leaving the entry with no `fiber` and
- *   producing no rejection — {@link assertEntriesLoaded} makes `boot()` reject
- *   on any such entry instead of returning a half-empty context.
+ *   producing no rejection — the process would otherwise exit 0 with a usable
+ *   config typo reported only as a log line; {@link assertEntriesLoaded} makes
+ *   `boot()` reject on any such entry instead of returning a half-empty
+ *   context.
  *
  * @module @deepseek-ai/dsh-app-boot
  */