Support DSH 0.2 and prepare v0.1.0 release

[jackie-cqz]

DSH has moved to the 0.2 release line, while this plugin only declared and tested 0.1 runtimes. This change adds 0.2.0-rc.2 dependencies and compatibility coverage, fixes the Windows ESM imports in live acceptance scripts, and prepares a versioned GitHub release with a prebuilt installation archive.

• Retain installation regressions for DSH 0.1.7-rc.2 and 0.1.6-alpha.2 across the existing Windows/Linux, Node 22/24 CI matrix.
• Update both READMEs with a fixed release tag and a prebuilt archive install command; include CHANGELOG.md in the exact 10-file package payload. Correct pnpm 10 build allowlisting based on the actual Git installation error.
• Normalize lockfile download URLs to the official npm registry after verifying all affected integrity hashes against registry metadata.

Validation: typechecking, 782 plugin tests, two packaging-parser tests, build, strict packing and installation smoke checks pass. Live TypeSafe smoke: 8/8; scenario suite: 13 required assertions plus 4 characterization probes. Chromium checks four successful calls, nine result bars and reload replay without browser errors; the LLM driver is scripted, and Jev requests use the live API.

GitHub-source installation of the PR head passes in a fresh DSH home outside the plugin workspace: download, prepare build, host startup, four live Jev calls, nine Web result bars, and reload replay. All Windows/Linux and Node 22/24 CI jobs pass. Private plans, handoffs, specifications, credentials and acceptance fixtures are excluded from Git and release assets.

[jackie-cqz]

Reviewed commit 1390fa7. No actionable findings remain.

• The DSH and peer ranges explicitly include the 0.2 prerelease while retaining the two tested 0.1 runtimes. All locked DSH packages use 0.2.0-rc.2.
• Changes to runtime code are limited to the Windows-safe ESM imports in the two live acceptance scripts; those scripts pass against the live API.
• The 10-file publish whitelist, entry points, client factory, disposal and tool calls pass the package gates.
• Clean GitHub installation confirms the prepare build and DSH Web integration without relying on the plugin workspace node_modules. The README now uses the pnpm configuration key confirmed by that installation.
• Chromium confirms all four live tool calls, nine probability bars, replay after reload, and no page errors. The test driver is scripted; TypeSafe calls are live.
• All eight CI jobs associated with this head pass. Tracked files and release payload contain neither the local key nor machine home paths; private acceptance fixtures and planning documents are excluded.