refactor(paths): collapse harness home resolution into one resolver

Delete @deepseek-ai/dsh-home and make dsh-paths the sole owner of the
single-root harness home ($DSH_HOME || ~/.dsh). Migrate tool-bash,
skill-local, and agent-spine-demo off dsh-home, and fold telemetry's
divergent globalConfigDir onto the shared resolver, dropping its second
XDG/APPDATA policy and the deepseek-harness namespace so the anonymous
id lives under the harness home. Add dshHomeDisplay() for symbolic
user-facing paths, replacing workspace-context's bespoke check.

packages/util/paths/README.md

@@ -4,6 +4,10 @@ Shared filesystem path helpers for DeepSeek Harness user data.
 
 ## DSH home
 
+`resolveDshHome()` resolves the single-root DeepSeek Harness home. Precedence, highest first: an explicit configured path, `$DSH_HOME`, then `~/.dsh`. The harness keeps all user data under one root.
+
+`dshHomeDisplay()` names an active root symbolically for user-facing paths: `~/.dsh` for the default home, `$DSH_HOME` for any configured home. It never leaks an absolute machine path.
+
 `DSH_HOME_DIR_NAME` owns the default user-data directory name: `.dsh`.
 
 `defaultDshHome()` returns the default DeepSeek Harness home by joining the operating-system home directory with `.dsh`, using Node's platform path rules.

packages/util/paths/src/index.ts

@@ -36,7 +36,10 @@ export function expandHomePath(path: string): string {
 }
 
 /**
- * Resolve an explicitly configured, environment-selected, or default DSH home.
+ * Resolve the single-root DeepSeek Harness home.
+ *
+ * Precedence, highest first: an explicit configured path, `$DSH_HOME`, then
+ * `~/.dsh`. The harness keeps all user data under one root.
  * @param configured - explicit harness-home override, which has highest precedence.
  * @param env - environment mapping used to read `DSH_HOME`.
  * @returns the normalized absolute harness home path.
@@ -45,3 +48,15 @@ export function resolveDshHome(configured?: string, env: Record<string, string |
   const selected = configured ?? env[DSH_HOME_ENV] ?? defaultDshHome()
   return resolve(expandHomePath(selected))
 }
+
+/**
+ * Describe a resolved harness home symbolically for user-facing display.
+ *
+ * It never returns an absolute machine path: the default home is labelled
+ * `~/.dsh`, and any configured home is labelled `$DSH_HOME`.
+ * @param resolvedHome - the absolute path returned by {@link resolveDshHome}.
+ * @returns `~/.dsh` for the default home, otherwise `$DSH_HOME`.
+ */
+export function dshHomeDisplay(resolvedHome: string): string {
+  return resolvedHome === resolve(defaultDshHome()) ? DEFAULT_DSH_HOME_DISPLAY : `$${DSH_HOME_ENV}`
+}

packages/util/paths/tests/paths.spec.ts

@@ -1,10 +1,11 @@
 import { homedir } from 'node:os'
-import { join } from 'node:path'
+import { join, resolve } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import {
   DEFAULT_DSH_HOME_DISPLAY,
   DSH_HOME_DIR_NAME,
   defaultDshHome,
+  dshHomeDisplay,
   expandHomePath,
   resolveDshHome,
 } from '@deepseek-ai/dsh-paths'
@@ -24,11 +25,16 @@ describe('dsh path helpers', () => {
     expect(expandHomePath('~other/.dsh')).toBe('~other/.dsh')
   })
 
-  it('resolves explicit DSH home before environment and default locations', () => {
+  it('resolves explicit path before DSH_HOME and the default', () => {
     const envHome = join(homedir(), 'env-dsh')
 
-    expect(resolveDshHome(undefined, { DSH_HOME: '~/env-dsh' })).toBe(envHome)
     expect(resolveDshHome('/tmp/explicit-dsh', { DSH_HOME: '~/env-dsh' })).toBe('/tmp/explicit-dsh')
+    expect(resolveDshHome(undefined, { DSH_HOME: '~/env-dsh' })).toBe(envHome)
     expect(resolveDshHome(undefined, {})).toBe(defaultDshHome())
   })
+
+  it('labels a resolved home by whether it is the default root', () => {
+    expect(dshHomeDisplay(resolve(defaultDshHome()))).toBe('~/.dsh')
+    expect(dshHomeDisplay('/some/other/root')).toBe('$DSH_HOME')
+  })
 })