feat(cli): even out the shipped tool rosters across both surfaces

The two shipped surfaces offered different tools for no recorded reason:
session checkpoints, tool-result pruning, the goal tools, and Ralph were in
`tui.cordis.yml`; `tool-todo` and web search were in `web.cordis.yml`. Neither
offered session search, a string-replacement editor, or a repeat-tool guard,
though none of the three is surface-specific.

Move the rows that are not surface-specific into `base.cordis.yml` and add
those three. Web search moves there too — the TUI decision the change that
made it a Web default deferred. Both surfaces now assemble the same 27 tools.

This adds only. No row is removed from either surface and no existing row's
configuration is edited: executors, sandbox composition, access defaults,
`tools.mode`, and the workflow tool are exactly what they were. Two rows stay
surface-specific: `tmux-context` (no terminal multiplexer in a browser) and
`session-reference` (its index has one writer owner).

Ship `dsh-mcp-client` as a dependency without a row: the plugin mounts one
server per instance and `command` is required, so a default would name a
third-party server and spawn it outside `ctx.bash` on every launch. The CLI
README carries the YAML for mounting one from a personal config.

apps/cli/config/web.cordis.yml

@@ -80,28 +80,6 @@
 - id: fs-local
   disabled: true
 
-# The Web/headless product enables only the stable web_search model surface.
-# DeepSeek search resolves the same DEEPSEEK_API_KEY credential the Models page
-# manages for chat, at each search; its Messages endpoint is separate from the
-# chat-completions endpoint. Fetch remains disabled and no default fetch
-# provider is mounted.
-- insert:
-    - id: web
-      name: '@deepseek-ai/dsh-web'
-      config:
-        searchProvider: deepseek-official
-
-    - id: web-search-deepseek
-      name: '@deepseek-ai/dsh-web-search-deepseek'
-      config:
-        apiKeyEnv: DEEPSEEK_API_KEY
-        baseURL: !!js process.env.DEEPSEEK_SEARCH_BASE_URL
-
-    - id: tool-web
-      name: '@deepseek-ai/dsh-tool-web'
-      config:
-        fetch: false
-
 # ── web-only host rows, the transport layer, and the browser roster ─────────
 
 # `dshClient` rows are the browser roster the modules node half scans into
@@ -136,9 +114,6 @@
         writeEveryEvents: 200
         writeIntervalMs: 5000
 
-    - id: tool-todo
-      name: '@deepseek-ai/dsh-tool-todo'
-
     # Resolve bind host, SSH launch, and display once at boot, then mount the
     # matching dual-face directory picker. Mount -native or -browse directly in
     # an overlay to pin the interaction.