feat(cli)!: dsh boots profiles; plugin subcommand manages them via pnpm

dsh --profile <name> replaces the fixed entry modes: --config and -p are
removed, --patch adds overlays over the composed profile, a positional task
selects one-shot mode (requires the headless-runner row), and dsh web stays as
the alias for --profile web carrying the Web flag family as patches. dsh
plugin --profile <name> forwards verbatim to pnpm in the profile directory,
initializes on first use, and reconciles the dsh.plugins layer list after
add/remove (patch-less packages warn and stay plain dependencies). Config
dumps and the keyless web e2e scaffold compose the same bundle layers over the
same empty root as the boot.

packages/host/frontend-static/src/invariant.ts

@@ -4,8 +4,6 @@
  */
 
 import type { Context } from 'cordis'
-// Empty type import carries the Loader's Fiber#entry merge read below.
-import type {} from '@cordisjs/plugin-loader'
 import type { InvariantInstaller } from '@deepseek-ai/dsh-invariants'
 
 const PACKAGE_NAME = '@deepseek-ai/dsh-frontend-static'
@@ -16,33 +14,16 @@ export const name = 'frontend-static-invariant'
 export const inject = ['invariants']
 
 /**
- * Owned relation: the fallback seat and the owning fiber must stay symmetric —
- * after the fiber holding the seat unloads, the seat must be claimable again
- * (a stale fallback would keep serving a disposed plugin's dist). Checked on
- * every fiber teardown by probing the registerFallback single-owner contract:
- * when this package's plugin is not mounted, a claim+release cycle must
- * succeed twice; residue from a leaked disposer makes the second claim throw.
+ * No runtime invariant: the only owned relation is the single fallback seat,
+ * which cannot be probed from the teardown stream — `internal/plugin` fires
+ * before the disposing fiber's effects run, so the legitimate owner still
+ * holds the seat at notification time and any claim probe would
+ * false-positive on every correct disposal (unlike the webserver companion,
+ * whose reserved-path probes never collide with a live registration). The
+ * seat's register/release symmetry is covered by the package's
+ * real-composition HMR-safety test instead.
  */
-const install: InvariantInstaller = (ctx, fail) => {
-  ctx.on('internal/plugin', (fiber) => {
-    // Only audit teardowns of this package's own rows: while a live
-    // frontend-static row legitimately holds the seat, the probe would
-    // false-positive on the legitimate owner.
-    if (fiber.entry?.options.name !== PACKAGE_NAME) return
-    const server = ctx.get('httpServer') as
-      | { registerFallback(handler: () => void): () => void }
-      | undefined
-    if (server === undefined) return // torn down with the webserver itself
-    // The probe handlers are registered and immediately released, never invoked.
-    /* v8 ignore next 4 -- the arrow bodies are dead by design */
-    try {
-      server.registerFallback(() => {})()
-      server.registerFallback(() => {})()
-    } catch {
-      fail('frontend-static fallback disposer left the seat claimed — seat ownership and fiber lifecycle diverged')
-    }
-  }, { global: true })
-}
+const install: InvariantInstaller = () => {}
 
 /**
  * Register this package's invariant companion.

packages/host/frontend-static/tests/frontend-static.spec.ts

@@ -15,7 +15,6 @@ import { Context } from 'cordis'
 import Loader from '@cordisjs/plugin-loader'
 import Include from '@cordisjs/plugin-include'
 import HttpServer from '@deepseek-ai/dsh-host-webserver'
-import InvariantService, { type InvariantError } from '@deepseek-ai/dsh-invariants'
 import * as FrontendStatic from '../src/index.ts'
 
 let root: string | undefined
@@ -126,46 +125,3 @@ describe('real Loader composition', () => {
     expect(() => server.registerFallback(() => {})).not.toThrow()
   })
 })
-
-describe('invariant companion', () => {
-  const OWN_FIBER = { entry: { options: { name: '@deepseek-ai/dsh-frontend-static' } } }
-
-  // The vitest-wide invariant host (scripts/test-invariants.ts) mounts this
-  // package's companion automatically when the service is plugged.
-  async function setup(): Promise<Context> {
-    const ctx = new Context()
-    await ctx.plugin(InvariantService)
-    return ctx
-  }
-
-  it('passes on a clean seat release, skips foreign rows, and reports a leaked seat', async () => {
-    const ctx = await setup()
-    let fallback: unknown
-    ctx.provide('httpServer', {
-      registerFallback: (handler: unknown) => {
-        if (fallback !== undefined) throw new Error('webserver: fallback already registered')
-        fallback = handler
-        return () => { fallback = undefined }
-      },
-    } as never)
-
-    // A teardown of this package's own row with the seat released: no violation.
-    expect(() => { ctx.emit('internal/plugin', OWN_FIBER as never) }).not.toThrow()
-    // Foreign-row teardowns are not audited (a live legitimate owner would false-positive).
-    fallback = () => {}
-    expect(() => { ctx.emit('internal/plugin', { entry: { options: { name: 'other-package' } } } as never) }).not.toThrow()
-    // A leaked seat on our own teardown (disposer never ran): the probe cannot claim twice → violation.
-    expect(() => { ctx.emit('internal/plugin', OWN_FIBER as never) })
-      .toThrow(expect.objectContaining<Partial<InvariantError>>({
-        code: 'INVARIANT',
-        packageName: '@deepseek-ai/dsh-frontend-static',
-      }))
-    await ctx.fiber.dispose()
-  })
-
-  it('skips the audit when the webserver went down with the row', async () => {
-    const ctx = await setup()
-    expect(() => { ctx.emit('internal/plugin', OWN_FIBER as never) }).not.toThrow()
-    await ctx.fiber.dispose()
-  })
-})