chore: move dsworker baseline to DSH 0.1.1-rc.2

[Nocehi]

Summary

• move the exact DeepSeek Harness development/runtime baseline from 0.1.0-rc.6 to current published 0.1.1-rc.2
• align every DSH-facing workspace dependency/peer with that exact baseline, including subprocess containment, PathGuard, TaskCheck, request tracing, WorkerKernel, and the lean bundle
• make local DSH resolution generation-neutral: the root devDependencies["@deepseek-ai/dsh"] value is the single version authority, with DSH_NODE_MODULES, dshNodeModules(), assertDshVersion(), and dshCliPath()
• move transient profile/CLI helpers and composition assertions onto the generic resolver while preserving the existing model-geometry assertions as an actual regression gate

Why 0.1.1-rc.2

0.1.0-rc.7 has been superseded by published DSH releases. 0.1.1-rc.2 is the current installable published baseline. dsh-v0.1.2-alpha.1 is intentionally not folded into this PR: its large client/transport rewrite should be probed separately against dsworker's actual headless agent/session/tools/subprocess surfaces, and only promoted to a baseline once the coordinated npm package closure is available.

Intentional non-changes

• no TaskCheck behavior changes; this does not stack on or duplicate PR Characterize TaskCheck v1 authoritative finalization #2
• no provider/model behavior changes
• no snapshot values are pre-approved for 0.1.1-rc.2: the existing geometry/config snapshots remain authoritative until the suite is run
• historical integration-test filenames containing rc6 are left as names only where renaming would add noise; compatibility helpers resolve the currently configured DSH baseline

Draft blockers

The tracked package-lock.json must be regenerated for the exact 0.1.1-rc.2 closure and the runtime evidence refreshed from this branch:

npm install --package-lock-only --ignore-scripts
npm ci
npm run check

Run npm run check outside a nested sandbox so the bubblewrap integration boundary is real. Review any composition/snapshot delta before updating snapshots; do not mechanically rewrite the pinned geometry.

Once the lockfile is refreshed and the full provider-free gate is green on exact 0.1.1-rc.2, this PR can be marked ready.