refactor(cli): simplify profile composition and dump paths

- composeProfile keeps layers as bundle/user/overlay+flags segments instead
  of one flat list later re-sliced by index arithmetic; the row index drops
  the group-walk (profile trees are flat patch compositions) and the double
  composition.
- The config dump anchors on the profile's real empty root (written by the
  shared prepareProfile) instead of materializing a temp file, so dump and
  boot compose over the identical base by construction.
- dsh-base drops its patchPath export: the dsh.patch manifest field is the
  one contract; the package carries no runtime API.
- packageDirFromAnchor is paths-probe only (the require.resolve fast path
  duplicated the probe's outcome); basename() replaces hand-rolled path
  splitting; verify-cordis-config stops re-reading bundle manifests in-loop.

scripts/verify-cordis-config.ts

@@ -166,12 +166,12 @@ function validateAppResolution(): string[] {
   // per-layer resolution anchors on the bundle package directory.
   for (const manifestPath of globSync('packages/bundle/*/package.json', { cwd: root })) {
     const bundleDir = manifestPath.replace(/\/package\.json$/, '')
-    const dependencies = readManifest(manifestPath).dependencies ?? {}
+    const manifest = readManifest(manifestPath)
     const references = pluginReferences.filter(reference => reference.file.startsWith(`${bundleDir}/`))
     violations.push(...missingPluginDependencies(
       // A bundle may mount its own package (the web-app runtime row).
-      references.filter(reference => packageNameFromSpecifier(reference.name) !== readManifest(manifestPath).name),
-      dependencies,
+      references.filter(reference => packageNameFromSpecifier(reference.name) !== manifest.name),
+      manifest.dependencies ?? {},
       manifestPath,
     ))
   }