feat(loader): interpolate the entry disabled field

The Windows platform layer disables tool-bash and inserts the pwsh stack, but the shipped presets each mount a tool-bash row that re-enabled the tool on win32 — the session had both a PowerShell-backed bash tool and tool-pwsh, silently, because no spec pinned the composed preset layer.

The Loader now evaluates a disabled: !!js expression against the loader context at every mount decision; disabled is the only interpolated metadata field, and the raw node stays in the options so write-back keeps the !!js form. The standard/code/cordis presets gate tool-bash with process.platform === 'win32', verify-cordis-config allows expressions in disabled only, and the windows-shell spec pins the preset-level invariant.

apps/cli/config/agent-presets/code/agent.cordis.yml

@@ -46,10 +46,12 @@
 # the criterion for host-plane ownership — injection resolves before any session
 # exists, so there is no agent to key by. Behind a preset realm those variables
 # never reached the model's shell at all. `tool-bash` consumes the host registry
-# from here; the executor behind it (`bash-sandbox`) is host-plane too, where the
-# sandbox policy owns it.
+# from here; the executor behind it is host-plane too, where the sandbox policy
+# owns it.
 - id: tool-bash
   name: '@deepseek-ai/dsh-tool-bash'
+  # POSIX-only: the Windows platform layer swaps the bash stack for the pwsh stack.
+  disabled: !!js process.platform === 'win32'
 
 # ── filesystem ──────────────────────────────────────────────────────────────
 

apps/cli/config/agent-presets/cordis/agent.cordis.yml

@@ -40,10 +40,12 @@
 # the criterion for host-plane ownership — injection resolves before any session
 # exists, so there is no agent to key by. Behind a preset realm those variables
 # never reached the model's shell at all. `tool-bash` consumes the host registry
-# from here; the executor behind it (`bash-sandbox`) is host-plane too, where the
-# sandbox policy owns it.
+# from here; the executor behind it is host-plane too, where the sandbox policy
+# owns it.
 - id: tool-bash
   name: '@deepseek-ai/dsh-tool-bash'
+  # POSIX-only: the Windows platform layer swaps the bash stack for the pwsh stack.
+  disabled: !!js process.platform === 'win32'
 
 # ── filesystem ──────────────────────────────────────────────────────────────
 

apps/cli/config/agent-presets/standard/agent.cordis.yml

@@ -39,10 +39,12 @@
 # the criterion for host-plane ownership — injection resolves before any session
 # exists, so there is no agent to key by. Behind a preset realm those variables
 # never reached the model's shell at all. `tool-bash` consumes the host registry
-# from here; the executor behind it (`bash-sandbox`) is host-plane too, where the
-# sandbox policy owns it.
+# from here; the executor behind it is host-plane too, where the sandbox policy
+# owns it.
 - id: tool-bash
   name: '@deepseek-ai/dsh-tool-bash'
+  # POSIX-only: the Windows platform layer swaps the bash stack for the pwsh stack.
+  disabled: !!js process.platform === 'win32'
 
 # ── filesystem ──────────────────────────────────────────────────────────────