A profile manifest and a bundle manifest are different kinds and shared one
flat `dsh` section: `dsh.plugins` listed bundles (not plugins) and `dsh.patch`
declared a bundle's layer. Each kind now names its role — a bundle declares
`dsh.bundle.patch`, a profile declares `dsh.profile.bundles` — so a
package.json states which role it plays and the list name matches its contents.
`DEFAULT_PROFILE_PLUGINS` becomes `DEFAULT_PROFILE_BUNDLES`, and
`DshManifestSection` splits into `DshBundleManifest`/`DshProfileManifest`.
Pre-release: no compatibility shim; turtle-ui moved with it (bd5ff10).
- composeProfile keeps layers as bundle/user/overlay+flags segments instead
of one flat list later re-sliced by index arithmetic; the row index drops
the group-walk (profile trees are flat patch compositions) and the double
composition.
- The config dump anchors on the profile's real empty root (written by the
shared prepareProfile) instead of materializing a temp file, so dump and
boot compose over the identical base by construction.
- dsh-base drops its patchPath export: the dsh.patch manifest field is the
one contract; the package carries no runtime API.
- packageDirFromAnchor is paths-probe only (the require.resolve fast path
duplicated the probe's outcome); basename() replaces hand-rolled path
splitting; verify-cordis-config stops re-reading bundle manifests in-loop.
Profile bundles are npm packages declaring dsh.patch in their manifest:
dsh-base carries the former base.cordis.yml rows as one insert over the empty
profile root; dsh-web-app carries the web overlay plus a runtime glue plugin
owning what used to be launcher code (frontend dist resolution via
frontend-static, the web-surface prompt section, bash runtime variables, the
readiness-gated URL line); dsh-headless carries the one-shot runner driving a
task turn through the in-process API carrier under the launcher-provided
ctx.headlessIo seam.
