fix(dsh): 宿主 peer 标为 optional，避免插件自动装配框架依赖

[iceout]

背景

dsh-working-activity 的框架依赖由 DSH 宿主提供，但六个宿主 peer 仍未标为 optional。消费者启用 pnpm auto-install-peers 时，插件会触发宿主框架包及其嵌套 peer 的自动装配，与仓库 verify-manifest-deps.mjs 所表达的宿主提供依赖原则不一致。

当前 npm dsh-working-activity@0.5.1 在 pnpm 12.10.1 下的最小消费者解析可以成功，但生成的 lockfile 自动引入了 dsh-agent@0.1.0-rc.6 和 dsh-session、dsh-invariants 等 0.1.7-rc.2 框架包。此 PR 让缺失的宿主 peer 不再自动安装；消费者已有这些 peer 时仍保留兼容范围检查。

改动

• 为 @deepseek-ai/cordis、@deepseek-ai/dsh-agent、@deepseek-ai/dsh-invariants、@deepseek-ai/dsh-session、@deepseek-ai/dsh-system-prompt、@deepseek-ai/schemastery 补齐 peerDependenciesMeta.optional。
• 同步 package-lock.json 根 manifest 的 metadata；现在 12 个 peer 全部 optional。
• 已合入 upstream/main 441540a 并解决两个 manifest 文件的冲突。相对最新 main 仅两个文件、36 行新增；保留 0.5.1 版本、最新客户端 peer 和所有兼容范围。

消费者验证

在临时目录使用 pnpm 12.10.1、官方 npm registry，仅依赖本插件，运行：

pnpm install --lockfile-only --ignore-scripts --config.auto-install-peers=true --registry=https://registry.npmjs.org

产物	结果
npm 已发布的 0.5.1	解析成功，但自动引入宿主框架包及嵌套 peer
本 PR 构建后 npm pack --ignore-scripts 生成的真实 tarball	解析成功，依赖图仅包含插件及其直接依赖 zod，没有自动引入宿主框架包

该检查验证消费者依赖解析；宿主运行期由下列兼容测试覆盖。

本地验证

• pnpm install --frozen-lockfile：通过（pnpm 12.10.1）。
• verify:deps、verify:lockfiles：通过，12 个 peer 镜像一致。
• pnpm test：20 个文件、255 个测试通过，包含真实 rc.6 projection 集成测试。
• pnpm run build、pnpm run verify:client-bundle：通过。
• 使用与 CI 一致的 pnpm 11.28.5：test:alpha2 通过（1 个测试），test:rc2 通过（20 个测试）；均使用 frozen lockfile 与 strict peer 检查。
• verify-host-vocabulary.mjs：rc.6、rc.2 两条宿主线均通过。
• git diff --check：通过。

本机 pnpm 12 对 alpha.2 fixture 的旧本地依赖快照报 ERR_PNPM_OUTDATED_LOCKFILE；CI 指定的 pnpm 11 对现有 fixture lockfile 检查及测试均通过，此 PR 未调整 fixture lockfile。

历史背景

最初在 0.4.0 上观察到 pnpm 自动装配预发布 peer 后报 ERR_PNPM_NO_MATCHING_VERSION，关联 ccch1mneyyy/dsh-TUI#815。当前 0.5.1 + pnpm 12.10.1 的最小复现已能解析成功，因此不再声称所有 pnpm 安装必然失败。此 PR 的当前目标是消除插件自动装配宿主框架依赖的行为。

Summary by CodeRabbit

• Chores
  • Updated package compatibility metadata so several related integrations can be installed optionally.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 367e58c7-e1cc-49ae-b5fd-b8b81896aa9c

📥 Commits

Reviewing files that changed from the base of the PR and between 3bfa05d and 2c72c8d.

⛔ Files ignored due to path filters (1)

• packages/activity/working-activity/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• packages/activity/working-activity/package.json

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The package metadata marks six DeepSeek packages as optional peer dependencies. No exported declarations changed.

Changes

Peer dependency metadata

Layer / File(s)	Summary
Optional peer dependency declarations packages/activity/working-activity/package.json	Adds optional peer-dependency metadata for @deepseek-ai/cordis, @deepseek-ai/dsh-agent, @deepseek-ai/dsh-invariants, @deepseek-ai/dsh-session, @deepseek-ai/dsh-system-prompt, and @deepseek-ai/schemastery.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: ccch1mneyyy

Merge Risk: ⚪ Minimal · up to 2c72c

No supported-use failure is established by the available evidence, so no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: marking host peer dependencies as optional to prevent automatic framework dependency installation.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}