feat: support DeepSeek's official Harness desktop app and dsh 0.1.7 profiles

[yujiezhang-ops]

Summary

Stacked on #247 (codex/dsh-latest-adaptation); the first two commits here are that PR's. Review the last two commits, or merge #247 first and this diff collapses to them.

DeepSeek now ships its own desktop application, DeepSeek Harness (com.deepseek.dsh, Developer ID team NAN929V4UM, served from download.deepseek.com). The dsh-desktop Agent installed a third-party build (anywhere-labs "DSH Desktop") and wrote configuration into ~/.dsh/settings.yaml, which dsh 0.1.7 no longer reads.

Configuration layer (P0)

• dsh 0.1.7 moved live configuration to $DSH_HOME/profiles/<profile>/cordis.patch.yml, a top-level YAML sequence of loader patch rows (whole-config replacement per row). The legacy settings.yaml is imported once on first start and renamed settings.yaml.imported; agent-default-model has no import mapping, so a legacy write after that loses the default selection.
• New ResolveDSHConfigPath(home, profile). The desktop Agent (desktop profile) always writes the patch and creates the directory ahead of the app's first launch: the Electron shell is 0.1.7-only, and its initProfile fills in package.json / pnpm-workspace.yaml only where absent. The CLI Agent (web profile) writes the patch once dsh has created that profile, otherwise the legacy file, since npm latest is still 0.1.5.
• Patch writes keep every other provider in the llm-pi-ai row; rows the write does not address come back byte-for-byte (two-space indent, !!js tags and quoting preserved). Credentials stay at $DSH_HOME/.credentials.yaml from either layout.
• ReadDSHConfig tells the layouts apart by the document's root node kind.
• Fixture with the account-platform records the desktop app keeps beside refs proves the credential merge leaves them intact.

Desktop entry (P1)

• Package resolved from the vendor's electron-updater feed (dsh-desk/feeds/mac-arm64/nightly-mac.yml, dsh-desk/feeds/win-x64/nightly.yml), served bytes verified against the feed's sha512. Host allowlist reduced to download.deepseek.com; GitHub release lookup and dshdesktop.cn mirror removed.
• Signature pinned to the vendor: bundle id + Team ID + spctl notarization on macOS, publisher on Windows. Previous checks accepted any valid signature.
• Only mac-arm64 and win-x64 are published. One function decides both Supported and the feed: Intel macOS is unsupported (no install entry shown), Windows on ARM installs the x64 build. Detection matches on bundle identifier and reports the version from disk (the app self-updates).
• Unofficial mark and disclaimer dropped for this row; the disclaimer path is still tested on a synthetic entry. Agent id dsh-desktop is kept so existing bindings resolve.

Test plan

• go test ./..., go test -race on internal/config, internal/desktopapp, internal/app
• go vet ./..., staticcheck ./...
• python3 scripts/check-docs.py
• cd frontend && pnpm run test && pnpm run build
• Verified against the real release on this machine: codesign -dv identity, spctl --assess accepted, feed sha512 matches the served mac-arm64 zip byte-for-byte, ~/.dsh/profiles/desktop/cordis.patch.yml is where 0.1.7 imported the old settings.

Review follow-ups (addressed in db3eacd, 3a70a65)

• P1: desktop Agent no longer falls back to settings.yaml when profiles/desktop/ is absent.
• P2: Supported now agrees with the feed lookup (Intel Mac unsupported; Windows ARM supported via x64).
• P2: WriteDSHOfficial validates reasoningEffort before touching .credentials.yaml.
• P3: scaffold header comment preserved; two-space indent; first-row-per-id reader.

Windows verification (ea8ad96, c93ff4e)

On Windows 11 x64 against the real deepseek-harness-0.1.7-rc.2-win-x64.exe:

• feed sha512 and size match the served bytes.
• Get-AuthenticodeSignature: Valid, subject CN="Hangzhou DeepSeek Artificial Intelligence Co., Ltd.", O="Hangzhou DeepSeek Artificial Intelligence Co., Ltd.", …, issuer GlobalSign GCC R45 EV CodeSigning CA 2020.
• The previous check refused this genuine installer twice over: the pinned name lacked the trailing period, and the PowerShell O= extraction split the quoted value at its comma ("Hangzhou DeepSeek Artificial Intelligence Co.). O= is now read in Go with a quote-aware parser (unit-tested), and verifyDSHWindowsInstaller accepts the real .exe end to end while verifyZCodeWindowsInstaller still refuses it.
• The installer is an assisted NSIS wizard, so installer-started hands off to the user rather than completing on its own.
• Installed through the wizard with defaults: per-user, %LOCALAPPDATA%\Programs\DeepSeek Harness\DeepSeek Harness.exe (HKCU uninstall entry, /currentuser), which is exactly what dshWindowsCandidates probes; Inspect reports it installed.
• First launch creates ~/.dsh/profiles/desktop/cordis.patch.yml as the header comment followed by a flow-style [], and ~/.dsh/.credentials.yaml with version: 1 and records but no refs. Against a copy of that directory WriteDSH refused (credentials refs must be an object); c93ff4e creates refs when absent and writes the empty list back in block style so rows are not all emitted on one line. Covered by TestWriteDSHProfileIntoAFreshDesktopInstall, and re-run against the real copy.
• go test ./internal/... on Windows: no new failures relative to main; the remaining ones are pre-existing Unix-mode / macOS-path assertions.

Not verified here

• Windows Inspect reports no version (macOS reads it from the bundle); the exe's ProductVersion or the HKCU DisplayVersion would supply it. Follow-up.
• Whether the running app accepts a BootAgent-written profile end to end (written and checked against a copy of the real ~/.dsh, not loaded by the live app).
• Whether the desktop welcome page's "API key configured" check recognises the BOOTAGENT_API_KEY reference (gateway providers). Follow-up.

🤖 Generated with Claude Code