refactor(cli): simplify profile composition and dump paths

- composeProfile keeps layers as bundle/user/overlay+flags segments instead
  of one flat list later re-sliced by index arithmetic; the row index drops
  the group-walk (profile trees are flat patch compositions) and the double
  composition.
- The config dump anchors on the profile's real empty root (written by the
  shared prepareProfile) instead of materializing a temp file, so dump and
  boot compose over the identical base by construction.
- dsh-base drops its patchPath export: the dsh.patch manifest field is the
  one contract; the package carries no runtime API.
- packageDirFromAnchor is paths-probe only (the require.resolve fast path
  duplicated the probe's outcome); basename() replaces hand-rolled path
  splitting; verify-cordis-config stops re-reading bundle manifests in-loop.

packages/bundle/base/src/index.ts

@@ -1,14 +1,9 @@
 /**
  * @deepseek-ai/dsh-base — the shared dsh core as a profile bundle. The
- * package's substance is `cordis.patch.yml` (declared by the `dsh.patch`
- * manifest field): every profile's first patch layer, inserting the base
- * plugin rows over the empty profile root. This module only names the patch
- * for consumers that need the path programmatically (the profile composer
- * resolves it through the manifest field, not through this export).
+ * package's substance is `cordis.patch.yml`, declared by the `dsh.patch`
+ * manifest field and resolved by the profile composer through that field;
+ * this module carries no runtime API.
  * @module @deepseek-ai/dsh-base
  */
 
-import { fileURLToPath } from 'node:url'
-
-/** Absolute path of this bundle's profile patch. */
-export const patchPath: string = fileURLToPath(new URL('../cordis.patch.yml', import.meta.url))
+export {}