[iuyo5678]

Follow up on #513, #516 and #517: DSH currently cannot invoke the new drag/step/view capabilities, and --match-text help suggests broader filtering than it provides.

DSH now exposes bsk_interact actions drag and step, bsk_inspect action=view, and sync saving/baseline/folding options. Live actions retain session ownership, queuing and observed-context checks. Offline views reject live session/context arguments. Literal find and matchText values use equals-form arguments so leading hyphens remain text.

Failed and cancelled steps remain failed host results while retaining the complete CLI receipt for the model and Web client. A per-execution finalizer preserves completed-action evidence through the real DSH cancellation path, clears its receipt after use, and respects host policy blocks. The composite action is never retried. PTC callers receive failed receipts in the error message, and nested receipts also use the supported additional-context channel so cancellation cannot discard the model's evidence. On process exit, obsolete cancellation timers are cleared before the bounded output drain begins.

CLI help and references explain that --match-text only folds plain stateless numbered fallback buttons, preserving business text, named/stateful controls and forms/dialogs. General literal search is directed to saved view --find. The DSH skill still names all six tools and fits its LF/CRLF byte budget.

The CLI wording and DSH integration are separate commits, followed by review fixes. Protocol and extension gesture/observation implementations are unchanged.

Validation:

• DSH: 668 tests across 29 files on Node 22, including the actual ToolRuntime, SDK PTC bridge, and shipped default Web tool-card renderer; typecheck, build, Biome and repository npm package verification passed.
• All 18 Node script tests passed, including LF/CRLF skill bundle validation.
• CLI: locked offline build, Rust formatting, actual short/long help checks, saved-file view --find, and leading-hyphen literal parsing checks passed.
• No live DSH/browser end-to-end session was run; browser subprocess I/O is stubbed in the integration tests, and PTC tests substitute only the code-execution worker beneath the real SDK bridge.