refactor(bundle): fold the Windows shell platform layer into the base rows

Entry \disabled\ interpolation makes the launcher's separate platform layer
unnecessary: the base bundle's cordis.patch.yml now gates both shell stacks
on its own rows — bash-sandbox/tool-bash disable on win32, and their twins
pwsh-sandbox/tool-pwsh mount only there with the inverted expression — so
exactly one shell stack mounts per host from one shared patch file.

windows.cordis.patch.yml and the launcher's windows-shell.ts injection (boot,
live recomposition, config dumps) are deleted, with the workspace-constraints
entry and the dsh-base exports/files entries following. The windows-shell spec
pins the effective per-platform roster through the real bundle layers, and
base.spec pins the four symmetric gates. The superseded active notes are
updated and cross-linked; the loader note records the fold itself.

packages/bundle/base/tests/base.spec.ts

@@ -3,12 +3,13 @@
  * field must name a real, parseable patch list.
  */
 
-import { readFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { resolve } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import * as yaml from 'js-yaml'
 import { entryListSchema } from '@deepseek-ai/cordis-plugin-include'
+import { evaluate } from '@deepseek-ai/cordis-plugin-loader'
 
 describe('dsh-base bundle', () => {
   it('declares a parseable patch list through the dsh.bundle.patch manifest field', () => {
@@ -39,34 +40,37 @@ describe('dsh-base bundle', () => {
     })
   })
 
-  it('ships the Windows platform layer as the confined pwsh roster over the ACL runner chain', () => {
+  it('gates each shell stack by platform with a symmetric disabled expression', () => {
     const root = fileURLToPath(new URL('..', import.meta.url))
     const parsed = yaml.load(
-      readFileSync(resolve(root, 'windows.cordis.patch.yml'), 'utf8'),
+      readFileSync(resolve(root, 'cordis.patch.yml'), 'utf8'),
       { schema: entryListSchema },
-    ) as {
-      id?: string
-      disabled?: boolean
-      insert?: { id?: string; name?: string }[]
-      config?: { policy?: string }
-    }[]
-    const disables = parsed
-      .filter(patch => patch.disabled === true)
-      .map(patch => patch.id)
-    // Only the POSIX bash stack is disabled: the Windows roster confines the
-    // pwsh executor through the ACL runner chain, so the sandbox/policy rows,
-    // the permission switcher, fs-sandbox, and the approval service all stay
-    // enabled exactly as on POSIX — only the shell is swapped.
-    expect(disables).toEqual(['bash-sandbox', 'tool-bash'])
-    const inserted = parsed
-      .flatMap(patch => patch.insert ?? [])
-      .map(row => row.id)
-    expect(inserted).toEqual(['pwsh-sandbox', 'tool-pwsh'])
-    // The patch no longer touches the permission/approval surface at all.
-    expect(parsed.find(patch => patch.id === 'approval')).toBeUndefined()
-    expect(parsed.find(patch => patch.id === 'permission')).toBeUndefined()
-    expect(parsed.find(patch => patch.id === 'sandbox')).toBeUndefined()
-    expect(parsed.find(patch => patch.id === 'sandbox-policy')).toBeUndefined()
-    expect(parsed.find(patch => patch.id === 'fs-sandbox')).toBeUndefined()
+    )
+    if (!Array.isArray(parsed)) throw new TypeError('base patch must parse to a patch list')
+    const rows = parsed.flatMap((patch): Record<string, unknown>[] =>
+      typeof patch === 'object' && patch !== null
+        ? (patch as { insert?: Record<string, unknown>[] }).insert ?? []
+        : [],
+    )
+    // Symmetric gating: each stack's executor and tool rows carry the same
+    // platform fact, inverted between the bash and pwsh twins, so exactly one
+    // shell stack mounts per host. Evaluate with a platform-scoped context
+    // (the `with` scope shadows the global `process`) so both outcomes pin on
+    // every host.
+    for (const [id, win32, linux] of [
+      ['bash-sandbox', true, false],
+      ['tool-bash', true, false],
+      ['pwsh-sandbox', false, true],
+      ['tool-pwsh', false, true],
+    ] as const) {
+      const row = rows.find(candidate => candidate.id === id)
+      if (row === undefined) throw new Error(`base patch must mount ${id}`)
+      const expression = (row.disabled as { __jsExpr?: string } | undefined)?.__jsExpr
+      if (expression === undefined) throw new Error(`${id} must gate on a !!js disabled expression`)
+      expect(Boolean(evaluate({ process: { platform: 'win32' } }, expression)), `${id} on win32`).toBe(win32)
+      expect(Boolean(evaluate({ process: { platform: 'linux' } }, expression)), `${id} on linux`).toBe(linux)
+    }
+    // The platform layer folded into these rows: no separate patch file ships.
+    expect(existsSync(resolve(root, 'windows.cordis.patch.yml'))).toBe(false)
   })
 })