feat(agentic): a dsh adapter beside the pi one

[pyramation]

Summary

The second adapter, which is the only real proof the neutral seam works: @agentic-kit/dsh binds the same @agentic-kit/db-tools into DeepSeek Harness and reads its transcripts, without a single dsh import anywhere upstream of the package.

Three seams, mirroring the pi adapter:

toDshTool(tool)      // HarnessTool  -> dsh ToolDefinition (zod parse stays authoritative)
createConstructivePlugin()  // registers the tools + gates them on tools/pre-execute
dshTranscriptReader  // dsh session events -> neutral TranscriptEvents

Judgment calls worth knowing:

• No @deepseek-ai/* dependency. The package declares dsh's contact surface structurally (DshToolDefinition, DshPlugin, DshPreToolDecision, …), so a host that already has dsh installed passes its objects in and nothing here pins a pre-release rc — and no ESM leaks into our dual CJS/ESM builds.
• No HarnessAdapter/HarnessRun implementation. dsh exposes no stable start/resume lifecycle to implement it against, so this stops at the three seams that do exist rather than inventing methods.
• Schema narrowing is lossy on purpose, and says so. dsh accepts a subset of JSON Schema, so convertDshParameters() returns { parameters, dropped }: disjoint unions become oneOf (dsh's spelling of anyOf), overlapping object unions widen to unconstrained and are listed in dropped, along with format/minimum/minItems. Nothing is silently weakened, because execute still runs tool.parameters.parse(args) before the tool sees anything. $ref throws rather than shipping a schema dsh can't resolve.
• The gate fails closed. tools/pre-execute asks dsh's approval service and treats only allowed-once as consent; with no approval service available a gated tool is denied rather than auto-run.

Along the way, the Constructive-specific gate resolvers move out of the pi adapter into db-tools as constructiveGateDeps(), so both adapters answer "is this project runnable / is there a data token / what would this template copy" from one place instead of two copies.

Link to Devin session: https://app.devin.ai/sessions/2d292e43fd2e4f34bb84605b5aa2a250
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring