kaleidosphere-dsh-plugin v0.1.0-preview.4 — capability-bound runtime registration

Functional increment

• bind runtime exposure to pinned EMBEDDED or validated EXTERNAL capability evidence
• map exactly six stable tools through the closed registration plan
• deny stale, tampered, substituted, widened, reordered and re-digested evidence before exposure
• pin DSH rc.8 dependency graph and bound all E2E waits

Verification

• 58/58 full tests
• package/vendor/third-party verification PASS
• exact-host rc.8 HMR/remove/reinstall/zero-residue lifecycle PASS
• deterministic Agent E2E PASS
• release tarball contract PASS
• GitHub CI PASS

Non-claims

No marketplace publication, real-LLM semantic tool-selection proof, arbitrary SQL, remote MCP or production readiness claim.