fix(web): assemble and package the shipped overlay

apps/cli/package.json

@@ -9,7 +9,9 @@
   },
   "files": [
     "lib/bin.js",
-    "cordis.yml",
+    "base.cordis.yml",
+    "tui.cordis.yml",
+    "web.cordis.yml",
     "src"
   ],
   "license": "BSD-3-Clause",

apps/cli/web.cordis.yml

@@ -70,10 +70,10 @@
       name: '@deepseek-ai/dsh-fs-sandbox'
 
 - id: bash-local
-  remove: true
+  disabled: true
 
 - id: fs-local
-  remove: true
+  disabled: true
 
 # ── web-only host rows, the transport layer, and the browser roster ─────────