fix(bundle): drop fs-local from the Windows layer — duplicate ctx.fs registration failed load

The Windows platform layer re-enables the base fs-sandbox row (removing its disable), but still inserted dsh-fs-local: both extend FileSystem and provide ctx.fs, so every shipped win32 profile failed at load. Delete the insert; fs-sandbox stays the single fs provider exactly as on POSIX. Sync the roster specs, the base/reference README pairs, the sandbox core doc (read-only grants no sink on Windows), the windows-shell JSDoc, and re-record the i18n pairings.

packages/bundle/base/tests/base.spec.ts

@@ -52,7 +52,7 @@ describe('dsh-base bundle', () => {
     const inserted = parsed
       .flatMap(patch => patch.insert ?? [])
       .map(row => row.id)
-    expect(inserted).toEqual(['pwsh-sandbox', 'tool-pwsh', 'fs-local'])
+    expect(inserted).toEqual(['pwsh-sandbox', 'tool-pwsh'])
     // The patch no longer touches the permission/approval surface at all.
     expect(parsed.find(patch => patch.id === 'approval')).toBeUndefined()
     expect(parsed.find(patch => patch.id === 'permission')).toBeUndefined()