v0.2.4 — dsh 0.2.x line support

What changed

dsh 0.2.0-rc.2 keeps every client/host seam this plugin uses
(ctx.uiWorkspace.openSession, the sessions list store, slots, and the
host's sessionReferenceResolver / webServer routes), so no code change was
needed — only the declared ranges: a caret on ^0.1.7-rc.1 cannot match
0.2.0-rc.2, which made pnpm warn about every client peer.

• spans ^0.1.7-rc.1 || ^0.2.0-rc.2 for the session-reference dependency and
  the client peer packages (both dsh lines are now supported)
• READMEs + cordis.patch.yml document the supported lines
• client-half.test.mjs asserts the widened ranges
• pnpm-lock.yaml resolves the dev/test packages to 0.2.0-rc.2

Verification (dsh 0.2.0-rc.2)

• 88 PASS / 0 FAIL (host-half + client-half + resolver-integration)
• GET /s/<id> still answers 302 → /?session=<id>
• the served client bundle carries the uiWorkspace opener (no sessions.open)
• a real browser session opened from a ?session= deep link end to end

Full diff: v0.2.3...v0.2.4