fix(client,host): review round — hooks-compartment occupancy, StrictMode re-arm, internal flow module, honest swap comment

- Directory-flow occupancy moves onto the inject face's reserved hooks
  compartment: apply publishes a stable observable per surface and the
  renderer binds useDirectoryFlow — no hand-rolled component subscriptions
  (the client contract's channel for registrant-private reactive facts).
- The native flow's alive guard re-arms in effect setup: StrictMode's
  development replay ran the cleanup once and every later outcome was
  discarded.
- NativeDirectoryFlow moves to a package-internal module; ./client exports
  only the Loader surface, tests import the internal module directly.
- The composition swap comment no longer advertises -browse as a complete
  swap before its dialog lands (stacked follow-up).

apps/cli/cordis.yml

@@ -252,8 +252,10 @@
 # mapping target (user config overrides these engineering defaults).
 # Directory-picking package, dual-face: the node half serves the gateway's
 # host.* picker RPCs, the browser half fills ui-workspace's directory-flow
-# slots — one row composes the whole interaction. Swap point: mount
-# '-browse' instead for the in-app browser (remote-capable).
+# slots — one row composes the whole interaction. Swap point: '-browse'
+# serves remote-capable listing primitives; its in-app dialog (and this
+# row's flip) land in the stacked follow-up PR — until then a '-browse'
+# composition has no picking affordance.
 - id: directory-picker
   name: '@deepseek-ai/dsh-host-directory-picker-native'