feat(python-runtime): package the dsh CLI and profile assets

Make the zero-code dsh-python-runtime-closure depend on the real @deepseek-ai/dsh application and every required profile peer, then package apps/cli's built bin instead of the deleted Python carrier. Rename executables to deepseek-harness-sdk-runtime-<platform>-<arch>, update wheel/platform/build workflow discovery, and install a Python dsh console command that requires explicit DSH_HOME before exec.

Include profile, bundle, preset, native addon, and shared-library assets needed by the full CLI. Remove the checked-in default cordis.yml and preserve the existing wheel distribution names, Python module names, sidecar validation, and wire identity. Runtime resolution and release tests pin the new artifacts and dev Node carrier.

python/sdk-runtime/src/deepseek_harness_runtime/__init__.py

@@ -1,22 +1,21 @@
-"""Locate the bundled DeepSeek Harness SDK runtime shipped with this package.
+"""Locate and execute the bundled dsh CLI shipped with the Python SDK runtime.
 
 Two runtime carriers coexist under ``runtime/``, both injected by the repo's
 ``scripts/build-exe-for-python-sdk.ts`` build (neither is checked into git):
 
 - **exe (production)**: single-file Node executables named
-  ``dsh-jsonrpc-agent-pkg-<platform>-<arch>`` (platform in {linux, macos}, arch in
+  ``deepseek-harness-sdk-runtime-<platform>-<arch>`` (platform in {linux, macos}, arch in
   {x64, arm64}) with a sibling ``-rg`` executable; macOS also uses a sibling
   ``-spawn-helper``. The target machine needs no Node installation.
 - **node (dev-only)**: the full deploy closure under ``runtime/node/``
   (``package.json`` + ``node_modules/``), executed as ``node
-  runtime/node/node_modules/@deepseek-ai/dsh-sdk-python-runtime/lib/packaged-bin.js`` on a
+  runtime/node/node_modules/@deepseek-ai/dsh/lib/bin.js`` on a
   system Node >= 22.19. It is the current checkout's source build, never
   selected automatically, and excluded from wheel/sdist distributions.
 
-``runtime/cordis.yml`` IS checked in: it is the default agent configuration
-the client SDK injects via ``$DSH_CORDIS_CONFIG`` for zero-config runs — the
-runtime itself always requires an explicit config and has no built-in
-fallback.
+Both carriers execute the same dsh command grammar. The Python SDK selects the
+``sdk`` profile and requires an explicit Harness home; the installed ``dsh``
+console command requires ``DSH_HOME`` for the same reason.
 """
 
 from __future__ import annotations
@@ -52,21 +51,6 @@ def bundled_package_dir() -> Path:
     return root
 
 
-def bundled_default_config_path() -> Path:
-    """Path of the checked-in default runtime configuration (``runtime/cordis.yml``).
-
-    The client SDK injects this path via ``$DSH_CORDIS_CONFIG`` when the caller
-    supplies no config and the launch resolves to the bundled runtime — the
-    runtime binary itself always demands an explicit config.
-    """
-    path = bundled_package_dir() / "runtime" / "cordis.yml"
-    if not path.is_file():
-        raise FileNotFoundError(
-            f"deepseek-harness-runtime-bin is missing the default runtime config at {path}"
-        )
-    return path
-
-
 def bundled_runtime_path() -> Path:
     """Absolute path of the bundled single-file runtime executable for the current platform.
 
@@ -78,7 +62,7 @@ def bundled_runtime_path() -> Path:
     touching callers).
     """
     tag = _current_platform_tag()
-    path = bundled_package_dir() / "runtime" / f"dsh-jsonrpc-agent-pkg-{tag}"
+    path = bundled_package_dir() / "runtime" / f"deepseek-harness-sdk-runtime-{tag}"
     if not path.is_file():
         raise FileNotFoundError(
             f"deepseek-harness-runtime-bin is missing the runtime executable at {path}. "
@@ -128,7 +112,7 @@ def _current_platform_tag() -> str:
     arch = _ARCH_TAGS.get(platform.machine().lower())
     if plat is None or arch is None:
         raise FileNotFoundError(
-            "no bundled dsh-jsonrpc-agent executable exists for this platform "
+            "no bundled DeepSeek Harness SDK runtime exists for this platform "
             f"(sys.platform={sys.platform!r}, machine={platform.machine()!r}); supported: "
             "linux/macos on x64/arm64. " + _EXE_ACQUISITION_HINT
         )
@@ -141,9 +125,9 @@ def _node_launch_args() -> tuple[str, str]:
         node_root
         / "node_modules"
         / "@deepseek-ai"
-        / "dsh-sdk-python-runtime"
+        / "dsh"
         / "lib"
-        / "packaged-bin.js"
+        / "bin.js"
     )
     if not bin_js.is_file():
         raise FileNotFoundError(
@@ -161,11 +145,24 @@ def _node_launch_args() -> tuple[str, str]:
     return (node, str(bin_js))
 
 
+def main() -> None:
+    """Execute the bundled dsh CLI with an explicitly selected Harness home."""
+    if not os.environ.get("DSH_HOME", "").strip():
+        print(
+            "dsh: the Python runtime command requires an explicit DSH_HOME; "
+            "it never uses ~/.dsh implicitly",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
+    argv = (*resolve_bundled_launch_args(), *sys.argv[1:])
+    os.execvpe(argv[0], argv, os.environ)
+
+
 __all__ = [
     "PACKAGE_METADATA_FILENAME",
     "RUNTIME_MODE_ENV_VAR",
-    "bundled_default_config_path",
     "bundled_package_dir",
     "bundled_runtime_path",
+    "main",
     "resolve_bundled_launch_args",
 ]

python/sdk-runtime/src/deepseek_harness_runtime/runtime/cordis.yml

@@ -1,58 +0,0 @@
-# Bundled default config. The runtime still requires an explicit
-# $DSH_CORDIS_CONFIG or argv path; the SDK injects this path for bundled
-# zero-config launches. SDK-set session-root and cwd variables have manual-run fallbacks.
-
-# Stdio JSON-RPC server entry; without it the agent has no SDK client.
-- id: sdk-jsonrpc-server
-  name: '@deepseek-ai/dsh-sdk-jsonrpc-server'
-
-# Agent spine; the SDK server creates agents per sessionId.
-- id: agent-core
-  name: '@deepseek-ai/dsh-agent-spine-demo'
-  config:
-    workspaceContext:
-      maxBytes: 65536
-
-# Stock DeepSeek adapters. The adapter resolves DEEPSEEK_API_KEY through the
-# credential seam and, with no provider mounted here, from the launching
-# environment; DEEPSEEK_BASE_URL follows the same environment ladder. Neither
-# is inlined, so this file names no secret and no route.
-- id: deepseek-llm-api-extensions
-  name: '@deepseek-ai/dsh-deepseek-llm-api-extensions'
-
-- id: session-log-deepseek
-  name: '@deepseek-ai/dsh-session-log-deepseek'
-
-- id: plugin-package-inventory-deepseek
-  name: '@deepseek-ai/dsh-plugin-package-inventory-deepseek'
-
-- id: llm-deepseek
-  name: '@deepseek-ai/dsh-llm-deepseek'
-
-# JSONL persistence; $DSH_SESSION_ROOT wins over ./.sessions in the process cwd.
-- id: sessions
-  name: '@deepseek-ai/dsh-session-persistence-jsonl'
-  config:
-    root: !!js process.env.DSH_SESSION_ROOT ?? './.sessions'
-
-# Persistence owns durable storage; this separate policy explicitly selects
-# the request, tool-dispatch, and completed-step durability checkpoints.
-- id: session-checkpoints
-  name: '@deepseek-ai/dsh-session-checkpoint-policy'
-
-# Local bash executor; $DSH_CWD wins over the process cwd.
-# Managed child-process groups for the bash executor (spawn/kill/output plumbing).
-- id: subprocess
-  name: '@deepseek-ai/dsh-subprocess-local'
-
-- id: bash
-  name: '@deepseek-ai/dsh-bash-local'
-  config:
-    cwd: !!js process.env.DSH_CWD ?? process.cwd()
-
-# Local filesystem provider for workspace instruction loading. This does not
-# expose model-facing file tools by itself.
-- id: fs-local
-  name: '@deepseek-ai/dsh-fs-local'
-  config:
-    cwd: !!js process.env.DSH_CWD ?? process.cwd()