feat: add composable context mechanics and optional workspace plugins

[Grivn]

Structured context with composable access and operations

The default Runtime / Documents / Memory Spaces composition remains the starting point. Optional workspace Sources and Strategy enhancements add reviewed records, bounded file and resource access, native skill authoring, task execution, session collaboration, feedback and reviewed synchronization.

The shared layer now follows the actual mechanism of each operation. Core validates access kinds, result shapes, resource versions, continuations, execution receipts and composition decisions. The public Source SDK provides scoped records, reviewed revisions, read coverage, cursor binding and plan comparison. Sources keep their storage, domain validation and external drivers; enhancements keep their trigger rules. The general Workspace Strategy composes public capabilities and policy contributions without a business-role dispatch list.

The main DSH WebUI presents these distinctions through shared themed components: access and effect summaries, separate human-management operations, exact resource versions, execution states and explainable strategy decisions. The plugin manager supports discovery, dependency previews and reversible activation. Composition previews explain source selection, read-only exclusions and budgets before saving. Native skills remain pending until reviewed and validated, and actual execution results and explicit feedback can produce a new review opportunity.

Compatibility

• Rebased on main 1363ebffaf19c9ab4badf0137f6fe87acacaf989, retaining its archive-scope and legacy-session fixes.
• Existing persisted data and default three-tier behavior remain compatible; additional capabilities are optional.
• Changesets target the next Core minor release; a release simulation verified Core 0.6.0 and matching ^0.6.0 peer ranges. These SDK additions require matching workspace builds until release.

Validation

• PR CI passed for exact head da6a68bdd741b3a1397591126bbd5d141b2ef0a2: Node 22.19 source verification, Node 20 public-entry compatibility and Node 24 packed-plugin verification.
• Full local verification: 1,219 root tests passed (7 skipped), 470 plugin tests passed, all 38 plugin builds/typechecks, deterministic build, real Headless activation and package validation.
• Packed verification: 38 independent plugin repositories and 39 artifacts, external public SDK consumers, real Starter installation and simultaneous activation of optional Strategy plugins.
• Follow-up Jobs/Learning UI changes: 23 tests, typechecks and builds passed.
• Real DSH 0.1.5-rc.1 + Mnemon 0.2.7 main WebUI: default/read-only previews, actual frozen View, plugin deactivate/reactivate, process execution and cancellation, file reads, resource validation/publication, native skill discovery, feedback-triggered decisions and native memory relations. Both native themes inspected.
• Current acceptance report and 24 screenshots. Public contracts and extension guide.

Remaining acceptance item

A fresh Flash generation has not completed in this run. Credentials were saved through the native DSH model settings, and the provider's API availability check returned true. Two real WebUI feedback-revision attempts timed out after 180 seconds; both retained the published native version and unresolved feedback. The native catalog still discovers the enabled version and its original resources.

A separate minimal streaming request received HTTP 200 in 172 ms, then timed out at 650 seconds with 54 keep-alive comments (756 bytes), zero generation data frames, zero content/reasoning characters and no completion marker. This covered the waiting period described in the provider's keep-alive documentation; it does not establish a global provider outage. There are no remaining live generation requests from this validation.

Implementation, automated checks and recorded local WebUI flows are available for review. The outstanding successful live-generation acceptance is blocked until the configured Flash service returns usable output. The manually authored script fixture passed actual native execution and publication, but is explicitly not counted as successful model generation. This PR remains draft while that acceptance item is outstanding.