feat(types): brand bash ids + stop brand erosion; extract Branded to dsh-brand

Type-only change (brands are zero-cost casts; no runtime/wire impact). Closes
the two gaps in the "brand ids that cross package boundaries" policy and fixes
the dependency direction so a capability package never pulls in an unrelated one.

- Extract the `Branded<B>` primitive into a new standalone type-only package
  `@deepseek-ai/dsh-brand` (packages/util/brand) with no harness-package deps.
  dsh-llm keeps its owned CallId but imports Branded from dsh-brand; dsh-session,
  dsh-agent, and dsh-bash all import Branded from there. dsh-bash depends on
  dsh-brand ALONE — never on dsh-llm or dsh-session (the architectural fix: a
  generic execution backend must not couple to the LLM or session vocabulary).
- Mint BashTaskId + OwnerToken in dsh-bash and thread them through BashTask.id,
  the get/ownerOf/list/readOutput/kill seam, the bash-local generation site, and
  the dsh-tool-bash validate/access surface. OwnerToken is a DISTINCT brand from
  SessionId so the seam stays decoupled; dsh-tool-bash is the single boundary
  that casts SessionId -> OwnerToken.
- Brand at the SOURCE, not via mid-pipeline casts: agent-loop's Config types
  agents[].id as AgentId and resumeSessionId as SessionId, so the brand enters
  at the config boundary and the inner create()/resume casts disappear (only the
  genuinely-new per-run session-id string is cast).
- Stop brand erosion: propagate CallId/SessionId/AgentId to the registry/store
  Map keys and public params/exports (SessionStore, AgentRegistry + factory
  options, the ACP session-id surface + ToolPresenter CallId map, the
  persistence coordinator, invariants pendingCalls, the pi-ai tool-call maps).
- Docs: document BashTaskId/OwnerToken in bash.md (type-equiv re-pasted), point
  the Branded type-equiv at dsh-brand, fix stale param types in the session/
  agent/bash READMEs, regenerate the cordis catalog + module graph.

Implements docs/rfc/proposed/architecture/2026-06-20-branded-ids.md

packages/llm/llm-pi-ai/src/adapter.ts

@@ -14,6 +14,7 @@
 import { stream as piStream } from '@earendil-works/pi-ai'
 import type { Model } from '@earendil-works/pi-ai'
 import { LlmAdapter, LlmError } from '@deepseek-ai/dsh-llm'
+import { CallId } from '@deepseek-ai/dsh-llm'
 import type { GenerateOptions, StreamChunk, ToolSchema } from '@deepseek-ai/dsh-llm'
 import { toPiContext, toStreamChunks } from './convert.ts'
 
@@ -69,8 +70,8 @@ type Payload = {
   stop?: unknown
 }
 
-function rawToolArguments(options: GenerateOptions): Map<string, string> {
-  const raw = new Map<string, string>()
+function rawToolArguments(options: GenerateOptions): Map<CallId, string> {
+  const raw = new Map<CallId, string>()
   for (const message of options.messages) {
     if (message.role !== 'assistant') continue
     for (const block of message.content) {
@@ -116,7 +117,7 @@ function patchPayload(payload: unknown, options: GenerateOptions, reasoning: PiA
     for (const call of message.tool_calls ?? []) {
       /* v8 ignore next -- malformed pi-ai payload guard: real tool calls always carry a string id */
       if (typeof call.id !== 'string') continue
-      const raw = rawById.get(call.id)
+      const raw = rawById.get(CallId(call.id))
       /* v8 ignore next -- pi-ai always emits a function object for assistant tool_calls; guard malformed payloads defensively */
       if (raw !== undefined && call.function !== undefined) call.function.arguments = raw
     }

packages/llm/llm-pi-ai/src/convert.ts

@@ -57,7 +57,7 @@ function parseArguments(raw: string): Record<string, unknown> {
  * same id.
  */
 export function toPiContext(options: GenerateOptions): PiContext {
-  const toolNames = new Map<string, string>()
+  const toolNames = new Map<CallId, string>()
   const messages: PiMessage[] = []
 
   for (const message of options.messages) {

packages/llm/llm/package.json

@@ -20,9 +20,11 @@
   ],
   "license": "BSD-3-Clause",
   "peerDependencies": {
+    "@deepseek-ai/dsh-brand": "^0.0.1",
     "cordis": "^4.0.0-rc.6"
   },
   "devDependencies": {
+    "@deepseek-ai/dsh-brand": "workspace:^",
     "cordis": "^4.0.0-rc.6"
   }
 }

packages/llm/llm/src/brand.ts

@@ -1,24 +1,15 @@
 /**
- * Branded (nominal) ID types.
+ * dsh-llm's owned branded id: `CallId` (tool-call correlation).
  *
- * A brand makes structurally-identical strings non-interchangeable at the
- * type level: an `AgentId` cannot be passed where a `CallId` is expected,
- * even though both are strings at runtime. Construction goes through the
- * per-type factory (a plain cast inside — zero runtime cost); comparison,
- * logging, and serialization all behave as ordinary strings.
- *
- * Policy: core packages brand the IDs they own — `CallId` here (tool-call
- * correlation), `SessionId` in dsh-session, `AgentId` in dsh-agent. Branding
- * is for IDs that cross package boundaries and could plausibly be confused;
- * not every string needs a brand.
+ * The `Branded<B>` primitive itself lives in `@deepseek-ai/dsh-brand` (a
+ * zero-dependency type-only package) so every owner of a cross-boundary id can
+ * brand it without depending on dsh-llm; see that package's README for the
+ * nominal-typing policy.
  *
  * @module @deepseek-ai/dsh-llm/brand
  */
 
-declare const BRAND: unique symbol
-
-/** A string carrying a compile-time-only brand `B`. */
-export type Branded<B extends string> = string & { readonly [BRAND]: B }
+import type { Branded } from '@deepseek-ai/dsh-brand'
 
 /**
  * Correlates a model-issued tool call with its result. Provider-issued for

packages/llm/llm/tsconfig.json

@@ -13,6 +13,9 @@
     },
     {
       "path": "../../../vendor/cordis"
+    },
+    {
+      "path": "../../util/brand"
     }
   ]
 }