feat(agent): add dsh agent — bridge cc-connect to a running DeepSeek Harness (dsh) web server

[whiteguo233]

Summary

Adds a new agent adapter agent/dsh that bridges cc-connect to a running DeepSeek Harness (dsh) web server on the same machine, so any cc-connect platform (Feishu, Telegram, WeChat, …) can drive dsh sessions — including the plugin-style Go module published at dsh-external/dsh-cc-connect.

What it does

• Sessions: POST /api/session.create with the project work_dir as cwd; same session id + cwd is idempotent server-side, so cc-connect restarts resume the same dsh conversation automatically.
• Streaming: consumes the aggregated WebSocket event stream (GET /api/events.mux); text/reasoning deltas are coalesced into sentence-sized chunks (dsh streams token-by-token) so IM delivery isn't word-by-word.
• Permissions: approval/requested → EventPermissionRequest (Feishu Allow/Deny buttons) → POST /api/respond; question/requested → AskUserQuestion cards with answers mapped back to option labels.
• Commands: /stop via session.cancel (AgentSessionCanceller), per-turn timeout_mins watchdog, /model via session.models/selectModel, /list + cross-project session-id validation, cc-connect doctor reachability check.
• cc-connect CLI integration: CC_PROJECT/CC_SESSION_KEY/CC_DATA_DIR injected into the first prompt of fresh sessions so in-session cron/timer/relay CLI calls work; ProjectMemoryFile() returns <work_dir>/AGENTS.md (dsh natively loads it), so relay/cron instructions land in the model context.
• Frame-loss protection: the mux stream aggregates every server session; the socket reader filters to the target session and gives critical frames (turn/end, approval/question requests, stream errors) blocking priority — without this a busy Web GUI flood could drop turn/end and leave the engine stuck after a permission answer.

Changes

• agent/dsh/ — new adapter (client.go RPC/WebSocket wire, session.go AgentSession + event mapping, dsh.go Agent + optional interfaces, aggregator.go delta coalescing) with 16 unit tests (mock dsh server over a real WebSocket) plus a smoke-tagged integration test against a live server
• cmd/cc-connect/plugin_agent_dsh.go — //go:build !no_dsh registration
• Makefile — dsh added to ALL_AGENTS
• config.example.toml — dsh project example (bilingual)
• CHANGELOG.md — Unreleased entry
• web/src/pages/Projects/ProjectList.tsx — add dsh (+ other registered-but-missing agents) to the new-project wizard's hardcoded AGENT_OPTIONS (the detail page already lists agents from the API)
• web/pnpm-workspace.yaml — fix malformed esbuild allowlist (onlyBuiltDependencies: esbuild scalar → allowBuilds: { esbuild: true }); without it vite build fails on pnpm 10.13+

Verification

• go vet ./agent/dsh/, CGO_ENABLED=0 GOOS=linux go build ./... (CI platform), go test -race ./agent/dsh/ — all green
• web build (tsc && vite build) — green
• End-to-end smoke test against a real dsh web server (session create → prompt → streamed reply) — passed
• Deployed in production on macOS for several days: streaming, rich cards, permission round-trips, /stop, resume all working

Notes

• Requires a running dsh web server on the same machine (default http://127.0.0.1:3080); config field base_url overrides.
• macOS go build ./... currently fails on origin/main itself (daemon/check_linger_other.go has //go:build !linux while daemon/launchd.go has //go:build darwin, redeclaring CheckLinger). Unrelated to this PR; the linux build (CI) is green. Happy to fix it separately if desired.