fix: complete recursive DSH checkup scanning

[Mr-Lucky]

Summary

Fix DSH checkup to recursively discover plugins referenced by installed bundles, wait for all scans to complete, and include per-plugin results in JSON and HTML reports.

Includes cycle detection, bounded recursion, pnpm layout support, path deduplication, and protection against dependency paths escaping the DSH profile.

Type

• Bug fix
• New feature / detection rule
• Refactoring
• Documentation

Testing

• npm run build passes
• npm test passes (617 tests)
• Manually tested the change

Related Issues

Closes #

[github-actions]

AgentGuard PR Review

I found one actionable issue in the recursive DSH discovery changes.

1. severity: high — src/feed/dsh-discovery.ts (discoverReferencedBundlePlugins / resolveInstalledDependency)
   • What can go wrong: bundle-referenced plugin resolution only looks for a child package under the current bundle’s own node_modules while walking upward from the bundle root. This misses valid bundle children installed at the profile level or reachable via pnpm-style layout that are not nested beneath the bundle directory itself. As a result, recursively referenced plugins may be silently skipped from checkup, leaving security-relevant DSH plugins unscanned.
   • Concrete fix: resolve referenced bundle plugins against the profile’s install tree, not just the bundle’s ancestry. Search the profile’s node_modules hierarchy (including pnpm virtual-store links) for the named dependency, then canonicalize and deduplicate the resolved path before recursing.