fix(web): include the HMR receiver in the initial client graph

packages/bundle/web-app/cordis.patch.yml

@@ -116,8 +116,8 @@
         lanAddresses: !!js ctx.get('webStartup')?.lanAddresses ?? []
 
     # The client-plugin reload chain: a dev-only row this bundle ships off,
-    # which the runtime row turns on for `--dev`. It is a row rather than a
-    # child of web-runtime because its node half is a client-side package,
+    # which the runtime row turns on before client discovery. It is a row rather
+    # than a child of web-runtime because its node half is a client-side package,
     # which a host-side bundle cannot import.
     - id: client-hmr
       name: '@deepseek-ai/dsh-client-hmr'
@@ -126,12 +126,14 @@
 
     # ── browser plugin roster (dshClient rows; node halves are layer-2 hosts) ──
 
-    # Dual-face: node half scans this very tree for dsh.client rows, composes
-    # window.__DSH_BOOT__, serves /plugins/<id>/client.js; browser half is the
-    # module table the shell kernel constructs before cordis exists (adopted
-    # as a plugin entry by the kernel, never fetched).
+    # Dual-face: this waits for the runtime row to decide whether HMR belongs
+    # in the first graph. The node half then scans this tree, composes
+    # window.__DSH_BOOT__, and serves /plugins/<id>/client.js; the browser half
+    # is the module table the shell kernel constructs before cordis exists
+    # (adopted as a plugin entry by the kernel, never fetched).
     - id: modules
       name: '@deepseek-ai/dsh-client-modules'
+      inject: [webClientRoster]
 
     # Owns both ends of the web transport: node half binds the gateway to the
     # webserver under /api; browser half is the fetch/SSE client.