fix(cli): keep session search tools opt-in on shipped surfaces

The shipped-roster change made @deepseek-ai/dsh-tool-session-query a
default row of the shared base.cordis.yml, so the TUI and Web surfaces
put the five session-search tools in front of the model. That
contradicts the recorded opt-in stance for the model-facing session
query consumer; the ACP example remains the mounted reference.

Remove the row from the shared base, the now-dangling disabled patch in
the opt-in core-web profile, and the workspace dependency. The
ctx.sessionQuery index stays: the TUI's /resume and the Web content
search consume it directly. Both shipped-composition tests now pin the
20-tool catalog.

apps/cli/tests/shipped-composition.e2e.ts

@@ -35,11 +35,6 @@ const EXPECTED_TUI_TOOLS = [
   'get_goal',
   'ralph',
   'read',
-  'session_event_read',
-  'session_event_search',
-  'session_event_trace',
-  'session_search',
-  'session_trace',
   'skill',
   'str_replace_editor',
   'subagent',