feat(bundle): degrade the Windows shell layer to danger-full-access

The Windows platform layer previously kept fs path-rule confinement
(sandbox-policy + fs-sandbox) next to the unconfined pwsh shell. Windows
has no OS sandbox runner (landlock/bwrap/seatbelt are POSIX-only), so the
shell can bypass fs-only path rules with one command — the policy was
theater. The layer now removes the whole sandbox stack (sandbox,
sandbox-policy, fs-sandbox disabled), mounts the unconfined dsh-fs-local,
and degrades to danger-full-access: permission/ui-permission leave the
roster and the approval policy is 'never'.

dsh-base declares dsh-fs-local so the profile module fallback links it for
cold starts; base.spec.ts pins the shipped Windows roster (disables,
inserts, approval policy); the Agent Note records the rejected fs-only
confinement alternative.

packages/bundle/base/tests/base.spec.ts

@@ -13,13 +13,60 @@ import { entryListSchema } from '@cordisjs/plugin-include'
 describe('dsh-base bundle', () => {
   it('declares a parseable patch list through the dsh.bundle.patch manifest field', () => {
     const root = fileURLToPath(new URL('..', import.meta.url))
-    const manifest = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8')) as { dsh?: { bundle?: { patch?: string } } }
+    const manifest = JSON.parse(
+      readFileSync(resolve(root, 'package.json'), 'utf8'),
+    ) as { dsh?: { bundle?: { patch?: string } } }
     expect(manifest.dsh?.bundle?.patch).toBe('./cordis.patch.yml')
-    const parsed = yaml.load(readFileSync(resolve(root, manifest.dsh!.bundle!.patch!), 'utf8'), { schema: entryListSchema })
+    const parsed = yaml.load(
+      readFileSync(resolve(root, manifest.dsh!.bundle!.patch!), 'utf8'),
+      { schema: entryListSchema },
+    )
     expect(Array.isArray(parsed)).toBe(true)
     // The base layer is one insert list over the empty profile root.
-    const rows = (parsed as { insert?: { id?: string }[] }[]).flatMap(patch => patch.insert ?? [])
+    const rows = (parsed as { insert?: { id?: string }[] }[]).flatMap(
+      patch => patch.insert ?? [],
+    )
     expect(rows.length).toBeGreaterThan(50)
     expect(rows.some(row => row.id === 'agent-loop')).toBe(true)
   })
+
+  it('ships the Windows platform layer as the documented danger-full-access roster', () => {
+    const root = fileURLToPath(new URL('..', import.meta.url))
+    const parsed = yaml.load(
+      readFileSync(resolve(root, 'windows.cordis.patch.yml'), 'utf8'),
+      { schema: entryListSchema },
+    ) as {
+      id?: string
+      disabled?: boolean
+      insert?: { id?: string; name?: string }[]
+      config?: { policy?: string }
+    }[]
+    const disables = parsed
+      .filter(patch => patch.disabled === true)
+      .map(patch => patch.id)
+    // The POSIX-only sandboxed stacks leave the Windows roster as one unit:
+    // shell (bash-sandbox/tool-bash), the permission switcher it requires,
+    // and the fs/sandbox policy stack whose OS runners do not exist on win32.
+    expect(disables).toEqual(
+      expect.arrayContaining([
+        'bash-sandbox',
+        'tool-bash',
+        'permission',
+        'ui-permission',
+        'sandbox',
+        'sandbox-policy',
+        'fs-sandbox',
+      ]),
+    )
+    const inserted = parsed
+      .flatMap(patch => patch.insert ?? [])
+      .map(row => row.id)
+    expect(inserted).toEqual(
+      expect.arrayContaining(['pwsh-local', 'tool-pwsh', 'fs-local']),
+    )
+    // Full danger-full-access degradation: no approval prompts on Windows.
+    expect(parsed.find(patch => patch.id === 'approval')?.config).toEqual({
+      policy: 'never',
+    })
+  })
 })