fix(cli): patch the agent-preset roots for every dsh launcher

The roots are an assembly fact (the shipped set beside this app's config,
the user's own under $DSH_HOME) but only `dsh web` patched them in, so the
merged `dsh run` booted the roster with no roots and failed resolving
`standard`. The shared profile boot now owns the patch for every launcher,
and master's interrupt_agent tool joins the standard composition's exact
catalog. The roster helpers the wire layer added (standingKeyFor,
serviceForAgent's chain guards, the direct mountPreset boundary) gain the
unit coverage the per-file gate requires.

apps/cli/tests/web-agent-presets.e2e.ts

@@ -115,7 +115,7 @@ describe('the shipped Web composition', () => {
       // depend on ripgrep being present on the machine.
       expect(toolNames(ctx, handle.agent).filter(name => name !== 'glob' && name !== 'grep')).toEqual([
         'ask_user_question', 'bash', 'create_goal', 'edit', 'exit_plan_mode',
-        'get_goal', 'list_agents', 'ralph', 'read', 'send_message', 'skill',
+        'get_goal', 'interrupt_agent', 'list_agents', 'ralph', 'read', 'send_message', 'skill',
         'str_replace_editor', 'subagent', 'subagent_fork', 'task_kill',
         'task_list', 'task_output', 'todo_write', 'update_goal', 'web_search',
         'workflow', 'write',