feat: continuously reconcile DSH compatibility

[MicroMilo]

Outcome

This PR turns DSH compatibility from a one-off load check into an always-on, exact-cell evidence loop:

• static tarball inspection extracts required peer ranges and bounded literal-use evidence;
• a fresh GitHub-hosted VM + restricted container installs the exact artifact through the exact DSH release;
• a profile-anchored wrapper resolves every required peer with import.meta.resolve(), imports the plugin, and boots headless DSH;
• accepted observations materialize compatibility-ledger.json, compatibility-ir.json, and compatibility-reverse-index.json.

A green install/load is no longer enough: a required host peer must be concretely resolved and satisfy the plugin's declared range.

Live evidence

OpenPencil × DSH 0.1.1-rc.1 × Node 24 completed all execution stages (artifact, profile, install, registration, direct plugin import, and headless boot).

The exact artifact was @zseven-w/dsh-openpencil@0.1.0-rc.1 with SHA-256 a4563e560e91bcd3a2a9302ee7dbee046b146c1bd0de6b27b7c7524fd52e77ca.

The measured compatibility frontier has 14 direct peers:

• 12 satisfied;
• @deepseek-ai/dsh-client-ui-slots@^0.1.0-rc.6 is absent from the current host. Static evidence found a type-only reference, so this is reported as declaration/typing drift—not a claimed headless crash;
• react-dom is runtime-imported, declares ^18.2.0, and resolves to DSH host version 19.2.8. Headless boot passes, but client-path React 19 compatibility still needs validation.

The end-to-end reconciliation accepted that report with zero rejections and materialized one cell, 14 relations, and 14 reverse-index entries.

Verification

• pnpm test — 320 tests passed
• pnpm run release:check
• isolated Actions evidence above

The PR remains Draft while the broader maintained matrix starts using this path.