feat(dsh): make the DeepSeek Harness store writable

[zzyking]

Stacked on #19 — until that merges, the diff here includes its commits. The
new commits are feat: make the DeepSeek Harness store writable, fix(dsh): keep the previous copy until a save succeeds, confine delete, and feat(dsh): write session format v4.

Companion to #32, which does the same for Kimi. Both follow from the read-only
question raised on #18/#19: the bar I set there (a harness needs an official
import command before txcript writes its storage) was stricter than the one the
rest of the tree holds — of the twelve writable harnesses, only opencode goes
through a vendor import command.

Why it works

dsh discovers sessions by walking <root>/<project>/<session>/. No index, no
import command — writing the layout it scans for is enough to be found.

What makes it exact rather than approximate

dsh validates what it finds, and three of its checks fail the entire
listing rather than skipping the one bad session. Each is a hard requirement on
the writer:

Check	Requirement
assertZstdHeaderFrame	first Zstandard frame decodes to exactly one line — the header
assertStoredIdentity	the header's id and cwd name the path the log was found at
checkRootEncoding	one root never mixes .jsonl with .jsonl.zstd

The first is the interesting one. Compressing the whole log as a single frame
still round-trips through txcript's own reader, because that decodes across
frame boundaries — so no test written against txcript catches it. Only the
official reader does.

The third is the most destructive: writing the default zstd encoding into a
root that dsh configured for plaintext breaks that root under both
configurations, taking down the user's whole session list. So the root decides
the encoding, and only an empty root falls back to dsh's own default.

A duplicate id across two project directories is rejected the same way, so
re-saving a session whose cwd changed retires the copy filed under the old one.

Writing format v4

dsh 0.2.0-rc.2 reads the current format (v4) with full validation, so Common
sessions are written as v4 directly, laid out as the turn/step lifecycle that
validation enforces: each tool call is started by tool/call and answered by a
tool-role tool/result before its step ends. A few events exist only because
dsh requires them:

• System head: an empty system/message heads the surface. dsh appends its
  system prompt when it resumes a session and accepts that only behind a system
  head; without one, the first resume works and the log dsh wrote fails its
  next load.
• Unanswered calls are closed with dsh's own TOOL_NOT_STARTED repair, and
  that turn ends interrupted.
• Model source: every assistant message names a provider (txcript) and
  model; its embedded stream is empty, the form dsh skips when replaying.

A native dsh body keeps its version, and save names the file for it
(session[.vN].jsonl[.zstd]), since dsh rejects a file name and header that
disagree. Other generations in the directory are removed.

Path derivation

Follows the official encodeSegment and projectKey: separators collapse to
-, [A-Za-z0-9._-] survives, every other UTF-16 code unit becomes ~XXXX,
and the project key is wrapped in --. Escaping over code units rather than
Unicode scalars is what keeps it injective over lone surrogates.

Escaping the separators is also what contains a traversing id: ../../evil
becomes the literal directory ..~002F..~002Fevil. That matches dsh, which
encodes rather than rejects — only a segment that is entirely . or .. is
special-cased.

Verification

dsh's own format catalog under its strictest settings (recovery: 'strict',
validation: 'current') accepts sessions converted from Claude Code, Codex,
and OpenCode (the largest about 14k events). A converted session was resumed
twice with dsh --profile headless --session-id; dsh answered from the
imported history, and the log it extended passed the same check after each
turn.

The official persistence backend's own listArtifacts and loadStored, run
against a txcript-written root:

• it lists both a normal session and a _no-cwd one;
• it decodes all 1257 event records of the former through decodeStorageRecord.

Re-introducing the single-frame bug makes that same check fail with dsh's own
corrupt Zstandard session log: first frame is not exactly one header line,
which is what confirms the oracle has teeth.

The derived project-directory names also reproduce those of the real local
session store exactly, including its non-ASCII path. Real dsh data was never
written to.

save writes to a temporary file and renames it into place, retiring other
copies only afterwards; delete only accepts a path that resolves (symlinks
included) to <root>/<project>/<session>.

dsh joins the path_safety and store_delete suites, and the CLI's refusal to
continue a dsh session in place is removed.

Full matrix green locally: fmt, clippy -D warnings, workspace tests,
no-default-features, both wasm32 invocations, MSRV 1.96.

[NishantJoshi00]

save deletes previous copies before writing the replacement. If that write fails, the old session is already gone. Can we retain it until the replacement succeeds? delete also needs to reject paths outside the configured session root.

[zzyking]

Both fixed in c5b491d:

• save: the replacement is written to a temporary file beside the log and renamed over it. Only after that succeeds does it remove a copy filed under a different project directory (left behind when a session's cwd changes). If the write fails, the temporary file is removed and the previous copy is untouched. There's a test that forces the write to fail and checks the old copy survives.
• delete: same guard as feat(kimi): make the Kimi Code store writable #32. It requires a session log, canonicalizes the path and root (so symlinks resolve first), and only accepts exactly <root>/<project>/<session>.

Separately, dsh moved on while this was open: 0.2.0-rc.2 writes session format v4, so I've updated the writer to match (a764222). This doesn't depend on our reader. Every log is checked with dsh's own format catalog under its strictest settings (recovery: 'strict', validation: 'current'), and real dsh resumed a converted session end to end:

• Common sessions are written as v4, using the turn/step lifecycle dsh's reader enforces. Each tool call is recorded as a tool/call, and its answer is a tool-role tool/result. A call that never got a result is closed with dsh's own TOOL_NOT_STARTED repair.
• The surface starts with an empty system/message. I found this requirement the hard way: without it, the first dsh --profile headless --session-id <id> resume works, but dsh then appends its system prompt mid-surface, and the log it wrote fails its next load. With the head, a converted session resumed twice and passed the strict check after each turn.
• A native dsh body keeps its version, and the file is named after it (session[.vN].jsonl[.zstd]). dsh rejects a log whose file name and header disagree. A save also removes any other generation left in the directory.
• I converted Claude Code, Codex, and OpenCode sessions (the largest is about 14k events) and all of them pass the strict check.

The details and provenance are in docs/formats/dsh.md. The branch is still stacked on #19.