fix(hmr,include): settle a failing boot instead of a silent exit 13

Master's transactional loader made the invalid-provider PTY case regress:
the HMR main watcher's initial scan refreshed the include mid-initial-apply,
the concurrent group updates stranded the include fiber, and once serialized
the failing apply's rollback deadlocked on HMR's refresh drain — dsh exited
13 with no diagnostic and the terminal stranded, the exact symptom this
branch fixes. Serialize every include child-tree mutation through one queue
and pass ignoreInitial to the HMR main watcher; the failing boot now settles
through boot()'s labelled rejection with the tree disposed and exit 1. The
PTY case asserts the settled diagnostic; the fail-loud release remains the
guard for rejections boot cannot see.

apps/cli/src/tui.ts

@@ -142,13 +142,15 @@ export async function runTui(
   const execve = process.execve?.bind(process)
   const app: { current?: Context } = {}
   // The Loader mounts entries concurrently, so `ui-tui` can already hold the
-  // terminal (raw mode, bracketed paste, keyboard protocol) when a sibling
-  // entry rejects — and that rejection arrives while `boot` is still in
-  // flight. Disposing the tree runs the TUI's own shutdown, which stops the
-  // terminal and hands the shell back; without it a failed boot returns to a
-  // corrupted prompt. `app.current` is captured from boot's `prepare` hook, so
-  // it holds the root context for the whole mounting window rather than only
-  // after boot resolves.
+  // terminal (raw mode, bracketed paste, keyboard protocol) when something
+  // else fails. A config-tree failure settles through `boot`, which disposes
+  // the tree itself; this release covers the rejections `boot` cannot see — a
+  // plugin's detached async work rejecting while mounting is still in flight
+  // or after the tree settled. Disposing the tree runs the TUI's own shutdown,
+  // which stops the terminal and hands the shell back; without it such a
+  // failure returns to a corrupted prompt. `app.current` is captured from
+  // boot's `prepare` hook, so it holds the root context for the whole mounting
+  // window rather than only after boot resolves.
   installFailLoud(NAME, process, async () => {
     await app.current?.fiber.dispose()
   })

apps/cli/tests/tui-keyless-smoke.e2e.ts

@@ -418,10 +418,13 @@ describe('dsh TUI keyless smoke (real Loader tree in a PTY)', () => {
   }, PTY_SMOKE_TEST_TIMEOUT_MS)
 
   // The Loader mounts entries concurrently, so `ui-tui` can already own the
-  // terminal when a sibling entry rejects on its config. Exiting straight from
-  // the fail-loud handler left raw mode and bracketed paste set on the user's
+  // terminal when a sibling entry rejects on its config. Exiting without the
+  // tree's own teardown left raw mode and bracketed paste set on the user's
   // shell, and the pending Device Attributes reply landed there as literal
-  // text. The launcher's release hook must reach the TUI's own teardown.
+  // text. The transactional mount must settle (an HMR initial-scan refresh
+  // once deadlocked its rollback into a silent exit 13) so `boot` disposes
+  // the tree — reaching the TUI's own shutdown — and rejects with the
+  // labelled diagnostic.
   it('restores the terminal when a sibling entry fails to validate during boot', async () => {
     const output = await smoke({
       label: 'dsh invalid provider config',
@@ -429,7 +432,7 @@ describe('dsh TUI keyless smoke (real Loader tree in a PTY)', () => {
       configPath: invalidProviderConfigPath,
       expectedExitCode: 1,
     })
-    expect(output).toContain('dsh: fatal load failure:')
+    expect(output).toContain('dsh: plugin tree failed to load:')
     expect(output).toContain('$.providers')
     // Bracketed paste is disabled again, which only `ProcessTerminal.stop()`
     // writes — proof the tree was disposed rather than exited out from under.