fix(host): adapt to DSH 0.2.1-alpha.5 — webStartup rename, invariants removal, peer floor

[HuanLinOTO]

Adapts the plugin to the DSH 0.2.0-rc.2 → 0.2.1-alpha.5 corridor (upstream compare, upgrade-guide series under docs/upgrade-guide/ at the tag). On a 0.2.1 host the plugin's row stayed PENDING forever — the injected webRuntime service never appears — and every /sidebar/* route answered 405, so the whole sidebar vanished. This PR moves the support line to 0.2.1-alpha.5+ without a runtime compatibility layer, per the repo's established policy.

Changes

webRuntime → webStartup (root cause of the vanishing sidebar)

• src/index.ts: inject renames webRuntime → webStartup; the trust fence reads ctx.webStartup.trustedHosts per request (field name unchanged — it now comes from repeatable --trusted-host flags).
• src/context-types.ts: SidebarWebRuntime → SidebarWebStartup, member renamed; all 11 test stubs follow.
• Same direction as fix(trust-fence): 按请求解析 web 信任面，穿越 webRuntime→webStartup 更名（#931） #932 / fix: 停止注入已移除的 webRuntime 服务；信任主机改从 argv 读取；编辑器头部新增下载按钮 #943 / fix(host): 兼容 DSH 0.2.1 的 webStartup 服务改名（0.2.1 上插件不挂载、/sidebar 全 405） #970 / fix(host): mount on DSH 0.2.1 while preserving legacy LAN trust #971 — this PR lands the rename on main together with the rest of the corridor rather than the fence alone.

Runtime-invariants system removed wholesale upstream

• Deleted: src/invariant.ts, the ./invariant export subpath, lib/invariant.js from files, the tsdown entry, the @deepseek-ai/dsh-invariants peer + devDep, and the ctx.invariants structural mirror.
• tests/sidechat-compaction-seed.spec.ts: the @deepseek-ai/dsh-session/invariant oracle (subpath deleted upstream) is restated as a local relational checker (turn/step counters, tool call/result pairing, contiguous seqs). The real oracles that survive — Session.create's seed validation and the foldSurface surface-equivalence fold — are unchanged.

TerminalBlockLabels.commandLine (new required member)

• Added in the single terminalBlockLabels() helper + the inline RowLabels in SideChatView; new sideChatBlockCommandLine dictionary key in all 20 locales (zh copy mirrors the host's own 命令第 {n} 行 wording).

Client navigation drift

• "Save side chat as new session" now navigates via uiWorkspace.openSession (client ISessions.open is gone in 0.2.1 — navigation moved to view owners); the old member remains as the pre-0.2.1 fallback, matching the pattern SubagentView already uses.

Manifest / CI / docs

• peers ^0.2.0-rc.2 → ^0.2.1-alpha.5; vendored @deepseek-ai/cordis ~4.0.5-alpha.2; @deepseek-ai/schemastery (dependency) ~3.18.5-alpha.2; devDeps re-pinned to 0.2.1-alpha.5; engines.dsh → >=0.2.1-alpha.5; lockfile regenerated (lockfile-only run).
• The alpha.5 client tarballs bare-import zod / picomatch — promoted into devDependencies (same convention as the earlier anser/shiki/katex promotions).
• CI mount lane pins @deepseek-ai/dsh@0.2.1-alpha.5; scripts/install.sh's user-facing npx fallback moves off its stale 0.1.7-alpha.1 pin; README badges + version-pick tables, the external-plugin guide's support line, and the AGENTS baseline notes follow the release-commit doc set.
• market-manifest's peer-shape guard pins the 0.2.1 tuple; plugin-meta's tarball listing parser strips the trailing CR Windows bsdtar emits.

Left to the maintainer's release commit (per the repo's chore(release) convention, cf. a0cfd30): version bump + CHANGELOG entry.

Verification

Against a locally built 0.2.1-alpha.5 dsh source tree (all @deepseek-ai/* resolutions probed at 0.2.1-alpha.5, vendored peers at 4.0.5-alpha.2/3.18.5-alpha.2/1.8.6-alpha.2):

• tsc --noEmit — clean (covers src + tests).
• vitest run — 2642 passed / 5 skipped / 3 failed; all three failures are local-environment artifacts, not regressions:
  • smoke.spec.ts "renders commit diffs": this working copy's git stash head wins git log --all --topo-order, and a stash WIP commit has no first-parent diff (clean checkout: passes);
  • e2e-aggregate-auth.spec.ts: needs a POSIX bash (Windows WSL shim + CRLF scripts);
  • git-worktree.spec.ts rename-budget case: exceeds the 30 s default only under the full parallel pool — passes in isolation (8/8).
• Built lib/ rescanned post-build: zero webRuntime / invariants / removed-symbol residue outside migration comments; lib/invariant.js gone.

Host-surface audit (stand-ins hand-diffed)

Because this plugin mirrors host services structurally (typecheck cannot catch drift there), every mirrored face was diffed by hand against the alpha.5 tree: webServer.register/registerUpgrade, host sessions.get/snapshotEvents, AgentRegistry.create/resume (meta.isSeeded + inheritedEventCount intact — sidechat seeding unaffected), SubagentRuntime.listDescendants, sessionTitle.rename, sessionPersistence.open/stat/read/close, SettingsForms.describe/update/configure, BlockAssembler/createUserMessage/ReasoningEffortId, client sessions.list/subagentAddress/fork/binding/scope/refreshProjections, sidebarRight.openTab/openResource/closeIn, slots, sidebarRightTabs, uiWorkspace.openSession — all present with compatible signatures. J1-05's delegation rework does not touch this plugin (it never called start/startContinuable/settleRun).

@huanlin/dsh-plugin-better-locale stays an optional peer — the integration is a guarded structural ctx.get('betterLocale') read with no value import, so the declaration is honest even with that plugin uninstalled.

Supersedes the fence-only variants of #905/#932/#943/#970/#971 for main (those branches may still carry useful extra hardening worth merging independently).

[HuanLinOTO]

Closing in favor of #979 (supersedes this PR).

Upstream main already landed the official alpha.5 adaptation in v0.28.0-alpha.0 (35ad6fc, release merge), so this PR's remaining delta was already absorbed. DSH has since published 0.2.1-rc.1 (git tag dsh-v0.2.1-rc.1, 1600d8a1; npm dist-tag next) — a version-only release: an npm diff across the 22 core @deepseek-ai/* packages from 0.2.1-alpha.5 shows version-field-only changes (plus @deepseek-ai/cordis peer/pin ~4.0.5-alpha.2 -> ~4.0.5 now that cordis 4.0.5 final is on npm). The floor bump to rc.1 continues in #979.

[HuanLinOTO]

Closing in favor of #974 (supersedes this PR).

Upstream main already landed the official alpha.5 adaptation in v0.28.0-alpha.0 (35ad6fc, release merge), so this PR's remaining delta was already absorbed. DSH has since published