chore: adapt the tasks/workflow/teams work to DSH 0.1.7-rc.1 (rebase onto v0.21.1)

Rebases the whole branch onto main's new 0.1.7-rc.1 baseline and lands the
adaptation the new host contract requires: the ui-primitives icon family rename
(Icon<Name><14|16> -> Icon<Name>Regular/Medium, with the 14px defaults pinned
back explicitly) and the StateDot redraw, the rewritten dsh-settings surface
(entry-id namespace, DSH schemastery with collected volatile returns,
configure auto:false), session format v4 (producer-owned source kind plus the
rewritten tool-result shape, parsers accepting both), the client snapshot move
to projectionsBySession.subagentCatalog with the jobs.list route behind it, the
^0.1.7-rc.1 peer floor with vendor and bare-import devDeps, the reduced chunk
set mirrored in all eight places, and the capability hand-backs (read-only
previews, terminal, browser).

Verified: typecheck and lint clean; 119 files / 1200 tests; build with no old
contract residue in the bundles; mount e2e 7/7; the tasks page still passes its
70-assertion real-browser contract.

.github/workflows/ci.yml

@@ -151,8 +151,10 @@ jobs:
       # Pin the DSH CLI the lane mounts into; the profile's bundle stack
       # (dsh-base / dsh-web-app) resolves from this installation. Keep in
       # step with the plugin's @deepseek-ai/* peer range when bumping.
-      # DSH 0.1.6-alpha.2 is the `alpha` dist-tag on npm (`latest` is still
-      # the 0.1.5 line); the lanes speak the slash-only RPC dialect
+      # Write an EXACT version, never a dist-tag: when 0.1.7-rc.1 shipped, the
+      # npm `alpha` tag still meant 0.1.7-alpha.2, rc.1 went out on `next`, and
+      # `latest` was still the 0.1.5 line — `@alpha` would mount a host this
+      # plugin no longer supports. The lanes speak the slash-only RPC dialect
       # (tests/e2e/host-protocol.ts).
       #
       # The larger heap is the fix for one of the two ways this step used to