feat(bundle): degrade the Windows shell layer to danger-full-access

The Windows platform layer previously kept fs path-rule confinement
(sandbox-policy + fs-sandbox) next to the unconfined pwsh shell. Windows
has no OS sandbox runner (landlock/bwrap/seatbelt are POSIX-only), so the
shell can bypass fs-only path rules with one command — the policy was
theater. The layer now removes the whole sandbox stack (sandbox,
sandbox-policy, fs-sandbox disabled), mounts the unconfined dsh-fs-local,
and degrades to danger-full-access: permission/ui-permission leave the
roster and the approval policy is 'never'.

dsh-base declares dsh-fs-local so the profile module fallback links it for
cold starts; base.spec.ts pins the shipped Windows roster (disables,
inserts, approval policy); the Agent Note records the rejected fs-only
confinement alternative.

packages/bundle/base/windows.cordis.patch.yml

@@ -1,18 +1,16 @@
 # The dsh-base Windows platform layer: applied by the dsh launcher on win32
-# hosts, between the bundle layers and the user layers, replacing the
-# POSIX-only bash stack with the PowerShell stack. The launcher reads THIS
-# file from the base bundle package (never through dsh.bundle.patch — that
-# field names the one universal layer). A Windows host that prefers bash
-# overrides the rows here through its profile or home cordis.patch.yml.
-#
-# Windows hosts cannot run the shipped bash executor (POSIX-only: hardcoded
-# `bash -c` argv and process-group semantics), so the shipped Windows
-# experience is PowerShell-native: pwsh-local backs `ctx.bash` and tool-pwsh
-# is the model-facing shell tool. dsh-permission requires a confining
-# executor (its presets bundle a sandbox mode the unconfined pwsh executor
-# cannot honor), so the permission service and its client knob leave the
-# Windows roster with the bash stack; the fs tools keep the sandbox policy
-# and the approval service, so file confinement and escalation still apply.
+# hosts, between the bundle layers and the user layers. Windows cannot run
+# the POSIX-only sandboxed stacks, so this layer swaps the shipped bash stack
+# for the PowerShell stack AND drops the sandbox entirely: no OS runner
+# exists on Windows (landlock/bwrap/seatbelt are POSIX-only), so any policy
+# would be theater — the unconfined shell could bypass fs-only path rules
+# with one command. Windows therefore degrades to danger-full-access:
+# unconfined pwsh + unconfined fs (`dsh-fs-local`), no permission switcher
+# (dsh-permission requires a confining executor), approval policy `never`.
+# The launcher reads THIS file from the base bundle package (never through
+# dsh.bundle.patch — that field names the one universal layer). A Windows
+# host that prefers bash or confinement overrides these rows through its
+# profile or home cordis.patch.yml.
 
 - id: bash-sandbox
   disabled: true
@@ -26,9 +24,25 @@
 - id: ui-permission
   disabled: true
 
+- id: sandbox
+  disabled: true
+
+- id: sandbox-policy
+  disabled: true
+
+- id: fs-sandbox
+  disabled: true
+
+- id: approval
+  config:
+    policy: never
+
 - insert:
     - id: pwsh-local
       name: '@deepseek-ai/dsh-pwsh-local'
 
     - id: tool-pwsh
       name: '@deepseek-ai/dsh-tool-pwsh'
+
+    - id: fs-local
+      name: '@deepseek-ai/dsh-fs-local'