fix(dsh): defer automatic work until step admission

[DongYao0]

Which issue or RFC does this PR close?

Addresses the hook-ordering part of #1785.

Rationale for this change

The DSH automatic pre-step hook previously performed PowerContext work before the downstream hook had admitted the step. Scope resolution, context preparation, prompt capture, and flushing could therefore occur even when a later hook rejected the step or failed.

This change defers all PowerContext side effects until the downstream decision returns kind: "enter".

What changes are included in this PR?

• Run the downstream pre-step handler before starting PowerContext work.
• Perform no PowerContext requests when the downstream step rejects or throws.
• Use the final downstream message batch for context preparation and prompt capture.
• Preserve cancellation and fail-open behavior.
• Preserve single-snapshot injection.
• Report downstream_failed and downstream_rejected in runtime observations.
• Add regression coverage for rejected, failed, rewritten, empty, and cancellation paths.
• Rebuild the checked-in DSH plugin output.

Are there any user-facing changes?

Yes. Rejected or failed DSH steps no longer trigger PowerContext requests or automatic capture side effects.

There are no breaking changes to public APIs or persisted formats.

How was this change tested?

• pnpm --dir integrations/dsh/plugins/powercontext test:all
  • 20 test files passed.
  • 276 tests passed.
• pnpm --dir integrations/dsh/plugins/powercontext build
  • Build completed successfully.
• Runtime acceptance was also exercised locally. The updated hook reached the post-admission Scope, prepare, capture, and flush path. Final completion was unavailable because the configured test inference provider returned 503 inference_unavailable during flush.

AI usage statement

OpenAI Codex was used for source-code tracing, implementation, regression-test design, and validation. The changes were verified using the repository test suite and build process.