fix(client): adopt the renamed client plugin manifest key

Master moved the browser-half declaration from a top-level `dshClient` to
`dsh.client`, and the new package still carried the old key. The Loader row
resolved, the host half applied, and the bundle built — the browser simply
never mounted the entry, so the session header rendered no task control at all
while `ctx.tasks` held a running task. Nothing reported it; the web e2e is
what caught it.

Also carried the merged tree onto master's current package rules: the release
manifest shape (version, repository, workspace-protocol peers, no `private`)
and `@deepseek-ai/cordis` in place of the old `cordis` specifier, plus the
connection handle the locale plugin's settings scope now reads in tests.

packages/client/ui-task/package.json

@@ -21,14 +21,16 @@
     "./src/*": "./src/*",
     "./package.json": "./package.json"
   },
-  "dshClient": {
-    "inject": [
-      "@deepseek-ai/dsh-client-locale",
-      "@deepseek-ai/dsh-client-runtime",
-      "@deepseek-ai/dsh-client-ui-conversation",
-      "@deepseek-ai/dsh-client-ui-primitives"
-    ],
-    "platform": "web"
+  "dsh": {
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-ui-conversation",
+        "@deepseek-ai/dsh-client-ui-primitives"
+      ],
+      "platform": "web"
+    }
   },
   "scripts": {
     "bundle": "tsdown",