refactor(mtmharness): align DSH 0.1.2 client contracts

[codeh007]

Summary

• migrate the Web plugin from the removed dsh-client-runtime API to official 0.1.2 Client, Store, and Renderer contracts
• remove static baseline packages from dsh.client.inject and update peer/dev dependency pins and lockfile
• update profile, CI, and release smoke commands to @deepseek-ai/dsh@0.1.2-alpha.1
• preserve Connect, Canvas, Coding, and standalone/embed behavior; remove only the obsolete runtime test stub

Related: codeh007/gomtm#657

Verification

• migrated package TypeScript check: passed against /workspace/deepseek-harness 0.1.2 declarations
• build: passed
• package verifier: passed
• Vitest: 25 files, 95 tests passed
• TAP: 21 tests passed
• package tarball pack-check: passed
• lockfile: CI=true pnpm install --frozen-lockfile --lockfile-only --offline passed

The official 0.1.2 npm packages are not published yet (@deepseek-ai/dsh-client-store is currently 404 and the public dsh CLI is still 0.1.1-rc.2), so the real registry install and profile smoke remain pending that upstream publication. The committed lockfile uses public npm tarball URLs and contains no local registry address.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e09517ab-eb09-49ab-aab1-27cc5f2143f4

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codeh007]

根据 issue 后续决定（等待官方 npm 提供 0.1.2-alpha.1，不创建不可安装的 PR），关闭此 PR。

已完成的源码迁移提交仍保留在远端分支 issue-657-mtmharness-audit，待官方包发布后重新从真实 npm metadata 生成带 integrity 的 lockfile，并复跑 Install、CI 和 profile smoke。