feat!: move to the alpha track — DSH 0.1.2-alpha.x only (v0.18.0-alpha.0)

DSH itself is still on its 0.1.2-alpha line (npm `alpha` dist-tag), so the
plugin mirrors it: v0.18.0-alpha.0 publishes under the npm `alpha`
dist-tag and supports DSH 0.1.2-alpha.x only. Stable-DSH (0.1.0-rc.8 ~
0.1.1-rc.2) users stay on v0.17.1 (npm `latest`). Verified end-to-end
against a real 0.1.2-alpha.2 host: full vitest suite, typecheck,
build/pack, consumer type surface, and the headless mount smoke 14/14
(the prerelease version also passes `dsh plugin add file:`).

- peer floor raised `^0.1.0-rc.8` -> `^0.1.2-alpha.2` (the mount install
  no longer warns: the old floor could not semver-match a prerelease
  host); dsh.plugin.json engines.dsh `>=0.1.2-alpha.2`.
- Dropped the pre-alpha compatibility layer:
  - e2e host RPC collapsed from the dot/slash dual dialect to slash-only
    (rpcAttempt; the 404-probe negotiation and its cache are gone), and
    parseLaunchUrl now requires the ?token= launch URL;
  - MarkdownText labels collapsed to the nested single shape (the cast
    became unnecessary against the alpha.2 declarations);
  - the defunct `@deepseek-ai/dsh-client-runtime` row is gone from the
    chunk externals allowlist (chunk-loader / tsdown / two specs) and
    from dsh.client.inject.
- market-manifest guard now allows an exact prerelease version (alpha
  cuts are not the market's verified `latest` target); release.yml picks
  the npm dist-tag from the version (prerelease -> `alpha`, else
  `latest`) so an alpha can never hijack `latest`.
- Docs retargeted: AGENTS.md §2/§3, README/README_EN badges + v0.18.0
  -alpha.0 section + install note (`dsh-better-sidebar@alpha`), guide.

.github/workflows/release.yml

@@ -6,6 +6,11 @@ name: Release
 # Trigger: a GitHub Release is published (tag vX.Y.Z). The tag MUST match
 # package.json `version`; the workflow verifies this before publishing.
 #
+# Dist-tag policy: a PRERELEASE version (e.g. v0.18.0-alpha.0 — the DSH
+# 0.1.2-alpha adapter track) publishes under the npm `alpha` dist-tag so the
+# `latest` install target keeps pointing at the last stable cut (which
+# supports the stable DSH line); stable versions publish as `latest`.
+#
 # One-time npm-side setup (manual, on npmjs.com):
 #   1. package `dsh-better-sidebar` -> Settings -> Publishing access
 #      -> Trusted Publishers -> "Add Trusted Publisher".
@@ -94,4 +99,7 @@ jobs:
 
       - name: Publish to npm
         if: github.event_name == 'release' || github.event.inputs.dry_run != 'true'
-        run: pnpm publish --provenance --access public --no-git-checks
+        run: |
+          TAG=$(node -p "require('./package.json').version.includes('-') ? 'alpha' : 'latest'")
+          echo "publishing to npm dist-tag: ${TAG}"
+          pnpm publish --provenance --access public --no-git-checks --tag "$TAG"