Merge branch 'feat/windows-pwsh-default' into feat/windows-acl-sandbox

# Conflicts:
#	packages/bash/pwsh-local/src/index.ts
#	packages/sandbox/sandbox-local/src/index.ts

packages/bash/tool-pwsh/src/background.ts

@@ -20,7 +20,7 @@ import type { BashProcess } from '@deepseek-ai/dsh-bash'
 export function processOutcome(proc: BashProcess): { status: 'completed' | 'killed'; detail: string } {
   // TODO(background-infrastructure-outcome): widen BashProcess with an explicit
   // infrastructure-failure outcome, then map spawn failures and
-  // sandbox.runnerFailed to task `failed`. The current seam aliases a spawn
+  // sandbox.runnerFailed to task `failed`. The current contract aliases a spawn
   // failure with a signal-less kill and a runner failure with an ordinary
   // wrapper exit; real nonzero command exits must remain `completed`.
   if (proc.status === 'killed') {

packages/bash/tool-pwsh/src/index.ts

@@ -1,5 +1,5 @@
 /**
- * Model-facing `pwsh` tool over the `ctx.bash` executor seam. Intended for
+ * Model-facing PowerShell Consumer of the `ctx.bash` capability seam. Intended for
  * Windows compositions where a PowerShell executor (e.g.
  * `@deepseek-ai/dsh-pwsh-local`) backs `ctx.bash`; the tool contract is
  * PowerShell-dialect: native `C:\...` paths and `$env:NAME` variables.
@@ -157,7 +157,7 @@ function resolveWorkdir(modelWorkdir: string | undefined, exec: { agent?: Agent
   return modelWorkdir
 }
 
-/** Detach the executor DTO from readonly seam interfaces into plain JSON data. */
+/** Detach the executor DTO from readonly Service Definition types into plain JSON data. */
 function canonicalPwshResult(result: BashRunResult): PwshForegroundResult {
   const output = (stream: BashRunResult['stdout']) => ({
     text: stream.text,