Merge branch 'stack/agent-profiles-1-seam' into stack/agent-profiles-3-wire

master extracted this layer's inline cold-resume resolver into
@deepseek-ai/dsh-api-remotes, whose `setup` was a fixed AgentSetup. A resumed
session composes the preset ITS header recorded, so the option becomes a
function of that header; the resolver builds the setup before the published
re-checks so those stay adjacent to `resume`.

Conflicts:
	docs/cordis-catalog/services.md
	docs/module-graph.md
	packages/host/apiproxy/package.json
	packages/host/apiproxy/src/api-proxy.ts
	pnpm-lock.yaml

apps/cli/src/web.ts

@@ -14,6 +14,7 @@ import { dshHomePath } from '@deepseek-ai/dsh-paths'
 import type { Context } from 'cordis'
 import type { PatchOptions } from '@cordisjs/plugin-include'
 import { addHarnessSourceSection } from '@deepseek-ai/dsh-app-boot'
+import type { EnvironmentSnapshot } from '@deepseek-ai/dsh-environment'
 import { runProfile, type ProfileRows } from './profile-boot.ts'
 
 const SOURCE_ROOT = fileURLToPath(new URL('../../..', import.meta.url))
@@ -141,9 +142,11 @@ export function webSurfaceContextEnabled(rows: ProfileRows): boolean {
  * every boot. The URL line is printed by the web-app bundle's runtime row
  * after Loader settlement.
  * @param flags - the parsed `dsh web` flag family.
+ * @param environment - this run's frozen environment snapshot.
  */
-export async function runWeb(flags: WebFlags): Promise<void> {
+export async function runWeb(flags: WebFlags, environment: EnvironmentSnapshot): Promise<void> {
   await runProfile({
+    environment,
     profile: 'web',
     patchFiles: flags.patches,
     deriveFlagPatches: rows => deriveWebFlagPatches(rows, flags),