fix(cli): patch the agent-preset roots for every dsh launcher

The roots are an assembly fact (the shipped set beside this app's config,
the user's own under $DSH_HOME) but only `dsh web` patched them in, so the
merged `dsh run` booted the roster with no roots and failed resolving
`standard`. The shared profile boot now owns the patch for every launcher,
and master's interrupt_agent tool joins the standard composition's exact
catalog. The roster helpers the wire layer added (standingKeyFor,
serviceForAgent's chain guards, the direct mountPreset boundary) gain the
unit coverage the per-file gate requires.

apps/cli/src/web.ts

@@ -10,7 +10,6 @@
 
 import { networkInterfaces } from 'node:os'
 import { fileURLToPath } from 'node:url'
-import { dshHomePath } from '@deepseek-ai/dsh-paths'
 import type { Context } from 'cordis'
 import type { PatchOptions } from '@cordisjs/plugin-include'
 import { addHarnessSourceSection } from '@deepseek-ai/dsh-app-boot'
@@ -19,12 +18,6 @@ import { runProfile, type ProfileRows } from './profile-boot.ts'
 
 const SOURCE_ROOT = fileURLToPath(new URL('../../..', import.meta.url))
 
-/** Shipped agent-preset root: beside this app's own config, in both source and built layouts. */
-const SHIPPED_PRESET_ROOT = fileURLToPath(new URL('../config/agent-presets/', import.meta.url))
-
-/** Harness-home directory holding locally authored agent presets. */
-const USER_PRESET_DIR = '.agent-presets'
-
 /** The webserver schema's all-interfaces bind literal: gates LAN-authority derivation. */
 const ALL_INTERFACES_HOST = '0.0.0.0'
 
@@ -104,16 +97,9 @@ function deriveWebFlagPatches(
   // inserts the client-hmr row), never pass-throughs of composed values.
   put('web-runtime', 'mode', flags.dev ? 'development' : 'production')
   put('web-runtime', 'lanAddresses', lanAddresses)
-  // The agent-preset roots are an assembly fact, like the values above: the
-  // shipped set sits beside this app's config and the user's own under the
-  // Harness home, and neither location is something a patch author chooses.
-  // Only patched when the composed tree actually mounts the roster.
-  if (rows.has('agent-presets')) {
-    put('agent-presets', 'roots', [
-      { path: SHIPPED_PRESET_ROOT, trust: 'system' },
-      { path: dshHomePath(USER_PRESET_DIR), trust: 'user' },
-    ])
-  }
+  // The agent-preset roots are patched by the shared profile boot: they are
+  // an assembly fact of every dsh launcher, and `dsh run` composes agents
+  // from the same roster this alias offers.
   const patches = [...overrides.entries()].map(([id, bag]): PatchOptions => {
     const composed = rows.get(id)
     if (composed === undefined) throw new Error(`dsh: patch target row "${id}" not found in the web profile composition`)