Add portable Preset packages and online Skill contract

[wisdomqin]

What changed

• add safe .dshpreset export, two-phase preview/import, conflict handling, validation, size limits, and atomic installation
• add Preset import/export controls to Agent preset settings and align the import button
• document the Preset Square MVP as an online SKILL.md workflow rather than a bundled client Skill
• document the Agent-facing $DSH_WEB_URL transfer API contract
• add regression coverage for archive safety, UI controls, and online Skill dependencies

Why

Preset Square needs a portable package boundary that an explicitly requested online Skill can orchestrate through the existing Harness shell and loopback API. The client must retain ownership of archive validation and installation instead of asking the model to unpack Presets directly.

User impact

Users can export custom Presets as .dshpreset files and safely preview/import packages from Settings. An online Preset Square Skill can use the same loopback endpoints without a Plugin, Tool, local Skill installation, or restart.

Validation

• npm test -- --run — 12 files, 52 tests passed
• npm run build — Electron main and preload production build passed
• live loopback export of tender-extract produced a 423,816-byte package
• live import preview detected 12 files, an absolute-path warning, and the existing-ID conflict without writing
• end-to-end DSH session read the local online Skill URL, confirmed readiness, and performed no install or publish action
• git diff --check