feat(anolisa): add native dsh adapter

[kongche-jbw]

Why

ANOLISA components need a framework-native way to register plugin bundles with
DeepSeek Harness without editing $DSH_HOME or maintaining component-specific
install scripts. This adds a reusable DSH driver so Tokenless and future
components can use the same adapter contract and DSH-owned lifecycle.

What changed

• Add a generic dsh framework driver that validates package.json, the
  nested dsh.bundle.patch declaration, the Cordis patch plugin id, and local
  bundle entry paths.
• Add repeatable anolisa adapter enable <component> dsh --profile <name>
  selection and reject implicit or non-DSH profile usage.
• Register and remove packages through dsh plugin --profile ..., persist one
  typed receipt for all selected profiles, verify status using exact package
  matches, and clean stale profiles during re-enable.

Other components can reuse the interface by declaring a normal ANOLISA adapter:

[[adapters]]
framework = "dsh"
adapter_type = "plugin"
plugin_id = "my-plugin-id"
source = "adapters/dsh"
dest = "{datadir}/adapters/{component}/dsh/"

[adapters.bundle]
entry = "package.json"

The source directory must contain an npm-compatible package name and nested DSH
bundle metadata:

{
  "name": "@example/dsh-plugin",
  "dsh": { "bundle": { "patch": "./cordis.patch.yml" } }
}

The patch id must match plugin_id, and relative plugin entries must remain
inside the bundle:

- insert:
    - id: my-plugin-id
      name: ./dist/index.js

ANOLISA then delegates registration to DSH with a link: package reference;
components do not write profile files directly.

Related issue

no-issue: introduce the shared DSH adapter contract needed by native plugins

User / Agent impact

Users can enable a component in one or more explicit DSH profiles:

anolisa adapter enable <component> dsh --profile default
anolisa adapter enable <component> dsh --profile web --profile headless

Disable and status use the profiles recorded by the enable receipt.

Risk and compatibility

• Public CLI, API, configuration, or documented behavior changed
• Cross-component contract changed
• Migration or rollback guidance is needed

The change adds a profiles field to EnableOptions and a dsh receipt
payload. Before downgrading to an ANOLISA version without this driver, disable
all DSH adapters so older binaries do not encounter the new receipt variant.

Validation

• cargo fmt --all -- --check
• cargo test -p anolisa-core --locked
• cargo test -p anolisa-cli enable_parses_repeatable_profiles --locked
• cargo clippy -p anolisa-core --all-targets --locked -- -D warnings
• cargo clippy -p anolisa-cli --all-targets --locked -- -D warnings
• cargo doc --workspace --no-deps --locked
• git diff --check

Documentation and rollback

The public Rust items and CLI help document the new contract; no standalone
guide is added in this change. Roll back by disabling DSH adapters first and
then reverting commit 9b96438e.

[qoderai]

[P1] reenable 清理时将 dsh bundle 解析失败一律视为包名变更，可能误删仍应保留的 profile 注册。
[P2] dsh status 在 verification=Unknown 且存在潜在失败时仍回退为 Unknown，总体验上不易区分“部分失败”与“全部未知”。
[P2] dsh profile 名称校验缺少长度/前缀边界，与可能的上游约束不完全对齐。

---

🤖 Generated by Qoder • View workflow run

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 895940883b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ikunkun-sys]

Reviewed current head 9b96438 against the official DSH bundle and CLI contracts at deepseek-harness commit 47f9438. Local formatting, clippy, workspace tests, docs, and a synthetic merge with current main pass, but the four inline correctness issues below are blocking.