feat(dsh): add configured asset inventory

[Cobb04]

Summary

Adds the first bounded DeepSeek Harness AGENT_CUSTOMIZE configured-assets slice for effective filesystem Skills and cwd-sensitive Instructions. It follows qualified native DSH precedence and ordering, reports configured-not-observed evidence rather than runtime use, and includes credential-free native verification.

Why

• Issue/Story: Refs [Feature]: Add DeepSeek Harness configured-asset inventory for Skills and Instructions #101
• User or maintainer outcome: Better Harness can inventory the filesystem Skills and Instructions a DSH workspace and cwd are configured with while keeping configured evidence distinct from runtime-use evidence.

Traceability and Scope

• Spec/ADR, if applicable: docs/specs/2026-08-23-101-deepseek-harness-configured-assets.md
• Acceptance criteria addressed: canonical DSH provider and capability registration; native Skill discovery, validation, precedence, and shadowing; cwd-sensitive Instruction ordering, deduplication, source limits, and rendered-byte budgeting; default-closed user-home authorization; bounded diagnostics and minimal CLI; pinned credential-free native comparison.
• Canonical owners changed: DSH agent-customize provider, registry, capability, and CLI; direct YAML dependency and Antigravity, host-artifact, and standalone runtime-ZIP closures; DSH native smoke and focused tests; configured-assets spec, reference, installation guide, and adapter matrices.
• Explicit non-goals: runtime/scoped Skill enumeration; full Cordis, Profile, or Preset resolution; MCP, Plugin, or Profile inventory; ASSET_PRACTICES; session-analysis changes; evidence-bundle, report, rendering, or output routing; Quickstart; and claims that configured assets were used at runtime.

Change Type

• Feature
• Bug fix
• Tests only
• Documentation/community
• Refactor with no intended behavior change
• Dependency, packaging, or infrastructure

Test and Review Evidence

Check	Result
Focused #101 suites	PASS — 79/79
DSH configured-assets native smoke	PASS — native DSH and Better Harness comparison phases; no credentials
Existing #99 DSH native smoke	PASS — pinned DSH 0.1.1-rc.2 discovery/invocation contract
DSH session regression	PASS — 87/87
Documentation link graph	PASS — 8/8
Antigravity and host artifact suites	PASS — 45 passed, 1 skipped
Clean-source host/runtime packaging	PASS — YAML package, runtime files, and license verified without generated-doc exclusions
npm run check	PASS
Root Vitest	PASS — 1,498 passed, 1 skipped
Harness	PASS — 161/161
Harness UI	PASS — 29/29
Harness Studio	PASS — 205/205
npm run pack:verify	PASS — npm 575 entries; runtime ZIP 837 entries
npm audit --omit=dev	PASS — 0 vulnerabilities

Manual or visual evidence: This is a non-visual configured-assets and runtime-packaging change. The credential-free native smoke compared filesystem Skill winners, Instruction order and deduplication, byte limits, budgeting, authorization, UTF-8 behavior, and supported symlink cases with pinned DSH owners. Clean-source host and standalone runtime artifacts loaded agent-customize without ERR_MODULE_NOT_FOUND.

Risk and Recovery

• Compatibility and cross-platform impact: macOS was fully exercised locally. Portable path tests and native fixtures cover Linux/Windows semantics; authoritative Linux and Windows execution remains pending the GitHub Actions matrix.
• Package, plugin, schema, or generated-file impact: adds exact production yaml@2.9.0 and closes Antigravity, host-artifact, and standalone runtime-ZIP dependency/license boundaries. No shared agent-customize schema or generated-state host packaging policy changes.
• Rollback or recovery path: revert this commit/PR to remove DSH AGENT_CUSTOMIZE support and its YAML dependency closures; no data migration or cleanup is required.
• Residual risk or unverified boundary: remote Linux/Windows CI is pending. Behavior is qualified to DSH 0.1.1-rc.2; later DSH releases require explicit requalification.

AI Involvement

• Level: Assisted
• Human review and validation: AI assisted repository and upstream-source research, specification drafting, test planning, implementation, review, and packaging diagnosis. Cobb04 reviewed scope alignment, RED-to-GREEN evidence, native parity, packaging causality, the final diff, and full validation, and remains the author and submitter.

Checklist

• I followed AGENTS.md, CONTRIBUTING.md, and the relevant canonical-owner guidance.
• The change is focused and does not include unrelated local or generated state.
• Tests and documentation match the behavior actually delivered.
• Markdown links were checked when documentation moved or changed.
• Cross-platform behavior was considered for Windows, macOS, and Linux.
• Package/runtime verification was run when shipped files or dependencies changed.
• User-facing or compatibility changes are recorded in CHANGELOG.md.
  Not applicable for [Feature]: Add DeepSeek Harness configured-asset inventory for Skills and Instructions #101: AGENTS.md permits CHANGELOG changes only when explicitly required, and the approved Story/spec does not authorize one; canonical adapter and installation documentation are updated instead.
• I have the right to contribute this work under the repository's MIT License.

[phodal]

Found two native DSH parity issues that need to be fixed. Both were reproduced against exact head 7ee924beda2c: raw Instruction byte-budget semantics and native DSH home normalization. Existing CI, the current-base merge tree, and the regular test suites are green, but these boundary cases are not covered. After fixing them and adding regression coverage, please also update the spec from Status: Draft to reflect the implemented state.

[phodal]

Re-reviewed exact head fc3e983e00e6. Both requested native DSH parity fixes are complete: raw Instruction content now drives render-budget accounting while trimming is limited to deduplication, and DSH home normalization matches the qualified native implementation for blank environment values and both tilde forms. The regression fixtures, pinned native comparison, current-base merge tree, full local validation, and Linux/macOS/Windows CI are green. No remaining findings.