Boot-safety net v0.3.0 — installing a bad plugin can no longer brick DSH.
- compose-check gate: after every install/update the persisted bundle stack is composed with the exact boot machinery in a subprocess (duplicate loader ids, invalid config, missing packages surface there)
- automatic rollback: on check failure the profile manifest is restored from a pre-op snapshot and the package is uninstalled — the profile is never left unbootable
- pre-install bundle fan-out audit: aggregate plugins whose dependencies also declare dsh.bundle (e.g. dsh-web-ui family) now require an explicit risk confirmation
- offline repair CLI: scripts/repair.mjs recovers an already-broken profile
- fresh hot-mounts dispose failed fibers instead of leaving dead entries