Merge origin/master (single-exe pipeline #253, duplication lint #281, side-sessions RFC)

Beyond line merges: python/sdk-runtime's deploy manifest gains
@deepseek-ai/dsh-mode — the single-exe closure gate
(verify-runtime-closure) requires every workspace peer of dsh-acp, and
the bridge's type-only peer edge on dsh-mode counts; the AGENTS.md
efficiency section is condensed to fit the 1820-word ceiling after
master's single-exe additions. Catalogs and graphs regenerated.

packages/core/agent/src/index.ts

@@ -202,6 +202,8 @@ interface FactorySlot {
  */
 export class AgentRegistry extends Service {
   private store = new Map<AgentId, AgentEntry>()
+  // TODO(agent-entry-mirror): derive exact-object checks from store.get(agent.id)
+  // plus entry.agent identity; this WeakMap mirrors the authoritative id map.
   private entries = new WeakMap<Agent, AgentEntry>()
   private factory: FactorySlot | undefined
 

packages/core/system-prompt/src/index.ts

@@ -103,6 +103,8 @@ export interface PromptSection {
 export interface AssembledSection {
   /** The contributing section's unique name. */
   name: string
+  // TODO(assembled-section-order): drop this output field; registry order has
+  // already sorted the array, and no production renderer/listener reads it.
   /** The contributing section's order (sections arrive sorted ascending). */
   order: number
   /** The resolved (but not yet interpolated) section text. */