feat: portable Skills and DSH 0.1.5 alignment / 可移植 Skill 与 DSH 0.1.5 对齐

[Yan-Zero]

English

Summary

• Align protocol validation, lifecycle cleanup, manifest normalization, Session mapping, and @dsh-std/adapter-dsh with DeepSeek Harness 0.1.5-rc.2, while retaining the supported 0.1.2-alpha.2 peer line and legacy manifest behavior.
• Add the pure @dsh-std/skill protocol and an automatically bundled DSH Skill provider. Standard components declare package-local Markdown entries; DSH lists metadata without reading the body, loads UTF-8 content on demand, and retracts it with the owning activation. Users still install only @dsh-std/adapter-dsh.
• Replace Changesets-driven version PRs with a package-version-driven OIDC release workflow. It detects actual SemVer increases, publishes in workspace dependency order, verifies existing tarball integrity on retries, selects prerelease/stable npm tags, and creates per-package Git tags and GitHub Releases.

Compatibility and safety

• Existing protocol definitions without agreement validators retain their behavior.
• Older Community v0.15 callers keep normalized empty manifest containers.
• Skill entries are confined to their package after lexical and symlink resolution, remain behind the publication barrier, and use an inert null publication marker rather than an executable handler.
• The DSH adapter continues to accept both the prior 0.1.2 line and the current 0.1.5-rc.2 line.

Verification

• pnpm check
• actionlint .github/workflows/release.yml
• Backward-compatibility build and tests against the existing dsh-codex standard facet
• Release-plan regression tests and a real six-package dry plan in dependency order

中文

概要

• 将协议校验、生命周期清理、Manifest 规范化、Session 映射和 @dsh-std/adapter-dsh 对齐 DeepSeek Harness 0.1.5-rc.2，同时保留 0.1.2-alpha.2 peer 兼容线与旧 Manifest 调用方式。
• 新增纯 @dsh-std/skill 协议以及由 adapter 自动内置的 DSH Skill provider。标准组件声明 package 内 Markdown 入口；DSH 枚举目录时不读取正文，只在请求时加载 UTF-8 内容，并随所属 activation 撤销。用户仍然只需安装 @dsh-std/adapter-dsh。
• 用 package 版本驱动的 OIDC 发布流程替换 Changesets 版本 PR。新流程只处理实际升高的 SemVer，按 workspace 依赖顺序发布，重试时核对既有 tarball integrity，自动选择预发布/稳定 npm tag，并为每个包创建 Git tag 和 GitHub Release。

兼容性与安全性

• 未提供 agreement validator 的旧协议 definition 保持原行为。
• Community v0.15 的旧调用方继续获得规范化的空 Manifest 容器。
• Skill 入口在词法解析和符号链接解析后都必须位于所属 package 内；资源仍经过 publication barrier，并以惰性 null marker 发布，不携带可执行 handler。
• DSH adapter 同时兼容之前的 0.1.2 系列和当前 0.1.5-rc.2 系列。

验证

• pnpm check
• actionlint .github/workflows/release.yml
• 使用现有 dsh-codex 标准 facet 完成向下兼容构建与测试
• 发布计划回归测试，以及当前六个待发布包的真实依赖顺序 dry plan

Closes #8