Merge remote-tracking branch 'origin/master' into codex/session-scoped-sandbox-roots

# Conflicts:
#	examples/acp-agent/tests/acp.snapshot.ts
#	packages/examples/agent-spine-demo/package.json
#	pnpm-lock.yaml

packages/bash/bash/src/invariant.ts

@@ -0,0 +1,22 @@
+/** Package-owned invariant companion for the bash seam. @module @deepseek-ai/dsh-bash/invariant */
+
+import type { Context } from 'cordis'
+import type { InvariantInstaller } from '@deepseek-ai/dsh-invariants'
+
+const PACKAGE_NAME = '@deepseek-ai/dsh-bash'
+
+/** Cordis companion plugin name. */
+export const name = 'bash-invariant'
+/** Service required before the companion can reserve package ownership. */
+export const inject = ['invariants']
+
+/** No runtime invariant: this stateless seam owns request/result types, while executors and policy own observations. */
+const install: InvariantInstaller = () => {}
+
+/**
+ * Register the bash invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export const apply = (ctx: Context): Promise<() => void> =>
+  Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install))