v0.1.0 — the package is now installable

The bug

pnpm install github:LeslieWylie/dsh-task-relay did not install a broken plugin. It failed outright:

ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED  The git-hosted package "dsh-task-relay@0.0.1"
needs to execute build scripts but is not in the "onlyBuiltDependencies" allowlist.

The package never reached node_modules. main and exports pointed at lib/index.js; .gitignore excluded lib/; the only build hook was prepack, which pnpm refuses to run for a git dependency unless the installing project allowlists it. Nothing in the DSH ecosystem is on npm yet, so a github: install is the only install — the plugin was usable by nobody except its author, whose profile link:s a locally-built copy.

All 26 unit tests passed the whole time. They import src/*.ts, and never touch the entry point the package actually publishes.

The fix

lib/ is now committed, so an install needs no build step, and the prepack hook that triggered pnpm's block is gone.

Committing build output buys installability and costs freshness, so both tests/boot.test.mjs and CI rebuild from src/ and diff against the committed lib/, failing on drift. Verified to go red when src/ changes without a rebuild.

Also

• config.root sets the queue directory (default $HOME/.dsh/task-relay). It was hardcoded, which meant any test that exercised the real tools had to write into the developer's own live queue. Separate profiles can now keep separate queues.
• tests/boot.test.mjs asserts the declared entry point exists, proves the committed build is current, then runs a full task_push → claim → handoff_write/read → done → cancel lifecycle through a real cordis tool registry and re-reads the queue from a fresh store instance — because "the queue survives the session" is the entire product claim, and a stub sharing the test's memory cannot demonstrate it.
• CI runs typecheck, unit tests, the staleness check, and installs the packed tarball into a scratch consumer project.
• private: true removed; @deepseek-ai/* peers marked optional so profiles bundling several plugins don't hit an unsatisfiable intersected peer range.

Verified from a clean pnpm install github:LeslieWylie/dsh-task-relay#v0.1.0: 26 unit tests, 21 boot assertions, all passing from the installed copy.