fix(tool-fs): CRLF-safe write diff, opaque meta, doc sync

Address the applied-hunk-diffs review:

- CRLF write overwrite emitted bogus every-line-changed hunks: write's
  `before` was LF-normalized but `after` kept the raw model content, so a
  CRLF rewrite of an LF file diffed every line. Normalize write's `after`
  to LF so both sides share the diff basis (edit already did). Regression
  test proves it fails on the raw-after path.
- The tool-private `meta` payload is now typed `unknown` (opaque) at every
  seam instead of `JsonValue`. This drops the `dsh-tools -> dsh-session`
  package edge that existed only to name the type, and removes the
  `FileDiff` index signature that had been widening the type solely for
  JsonValue-assignability. Serializability is still enforced at runtime by
  `Session.append`'s isJsonValue check, which was always the real guard.
- Sync the docs the new result/meta surface left stale: ToolResultView's
  diff card + ToolExecutionResult.meta in tools.md/session.md type-equiv
  blocks, the acp/tools READMEs, and the adding-a-tool cookbook; regenerate
  the cordis catalog and module graph.

packages/core/tools/src/index.ts

@@ -11,7 +11,6 @@ import { Context, Service } from 'cordis'
 import type { CallId, ContentBlock, ToolSchema } from '@deepseek-ai/dsh-llm'
 import { HarnessError } from '@deepseek-ai/dsh-llm'
 import type { Agent } from '@deepseek-ai/dsh-agent'
-import type { JsonValue } from '@deepseek-ai/dsh-session'
 import type {} from '@deepseek-ai/dsh-system-prompt'
 
 export {
@@ -88,13 +87,6 @@ export interface FileDiff {
   oldText: string | null
   /** Content after the change. */
   newText: string
-  /**
-   * Index signature so a `FileDiff` is a valid {@link JsonValue} member — a tool
-   * persists result-time diffs as `tool/result` `meta`, which must round-trip
-   * through the session log. Every declared field is already JSON-compatible;
-   * this only makes the structural compatibility explicit.
-   */
-  [key: string]: string | null
 }
 
 /**
@@ -247,12 +239,13 @@ export interface DiffResultView {
 /**
  * What a tool's `execute` returns. The bare {@link ContentBlock}`[]` form is the
  * common case (model-facing content only); the object form additionally attaches
- * a tool-private `meta` presentation payload ({@link JsonValue}) that the
- * registry threads onto the `tool/result` session event and hands back to the
- * tool's `presentResult`. `meta` is opaque to the core — the tool owns its shape
- * and validates it on the way out — and persists so replay reproduces the card.
+ * a tool-private `meta` presentation payload that the registry threads onto the
+ * `tool/result` session event and hands back to the tool's `presentResult`.
+ * `meta` is opaque to the core (`unknown` — the tool owns and narrows its shape),
+ * and MUST be JSON-serializable: it persists on the durable log (the session
+ * enforces this at `append`), so replay reproduces the card.
  */
-export type ToolExecuteReturn = ContentBlock[] | { content: ContentBlock[]; meta?: JsonValue }
+export type ToolExecuteReturn = ContentBlock[] | { content: ContentBlock[]; meta?: unknown }
 
 /** A registered tool: its schema plus the execution function. */
 export interface ToolDefinition extends ToolSchema {
@@ -286,10 +279,10 @@ export interface ToolResult {
   /**
    * The tool-private presentation payload the tool attached from `execute` (via
    * the object return form), threaded verbatim from the `tool/result` event.
-   * Opaque {@link JsonValue}; the tool narrows it back to its own shape. Absent
-   * when the tool attached none.
+   * Opaque (`unknown`); the tool narrows it back to its own shape. Absent when
+   * the tool attached none.
    */
-  meta?: JsonValue
+  meta?: unknown
 }
 
 /** One pending tool call, as it flows through the execution waterfall. */
@@ -336,10 +329,10 @@ export interface ToolExecutionResult {
   /**
    * The tool-private presentation payload from a successful `execute` (the object
    * return form). Threaded onto the `tool/result` session event and back into
-   * {@link ToolResult} for `presentResult`. Opaque {@link JsonValue}; absent when
-   * the tool attached none or the call failed.
+   * {@link ToolResult} for `presentResult`. Opaque (`unknown`); absent when the
+   * tool attached none or the call failed.
    */
-  meta?: JsonValue
+  meta?: unknown
 }
 
 /**