fix(ci): raise the global testTimeout and drop --legacy-peer-deps (real-CI feedback)

The first run of this PR against real Windows and real npm found two things
the local macOS pass could not:

1. ci-windows lost a THIRD file to vitest's 5000 ms default —
   `tests/git.spec.ts:85` ("caps status entries at the truncation limit")
   took 9607 ms building a pathological untracked set with real git calls.
   Three different files (git / powershell / agent-pty), one root cause, so
   per-file timeouts were whack-a-mole: vitest.config.ts now sets a global
   `testTimeout: 15_000`. The two heaviest suites keep their own 30 s budgets
   and a genuinely hung case still fails.

2. `--legacy-peer-deps` made the mount lane's CLI install broken instead of
   robust: it skips exactly the peers a global install has to supply, and
   `@deepseek-ai/cordis-plugin-group` — required at boot by
   `@deepseek-ai/dsh-app-boot` — is a peer, not a dependency, so the CLI died
   with ERR_MODULE_NOT_FOUND (`Cannot find package
   '@deepseek-ai/cordis-plugin-group'`) before the smoke could start. The
   flag is removed; the pin to a fully-published rc.2 (no ETARGET) plus the
   4 GB heap (no resolver OOM) is the whole fix.

Verified locally: a plain `npm install -g @deepseek-ai/dsh@0.1.5-rc.2` into a
scratch prefix (with NODE_OPTIONS=--max-old-space-size=4096) resolves the peer
(`dsh/node_modules/@deepseek-ai/cordis-plugin-group` present), that CLI reports
0.1.5-rc.2, and `DSH_CMD` pointed at it runs the mount lane green — 7 passed.
`pnpm test` stays green with the new timeout: 126 files / 1312 passed / 9 skipped.

Docs (plan §C, AGENTS.md §2, both READMEs' v0.19.1 entries) record the rejected
middle step and why, so nobody re-adds it.

.github/workflows/ci.yml

@@ -145,22 +145,27 @@ jobs:
       # at rc.1); the lanes speak the slash-only RPC dialect
       # (tests/e2e/host-protocol.ts).
       #
-      # `--legacy-peer-deps` + the larger heap are the fix for the two ways
-      # this step used to die (runs 34492160123 / 34491256626 / 34490912649
-      # and 34363627184): the pinned version's TRANSITIVES are declared as
-      # floating `^` ranges, so while upstream publishes a prerelease in
-      # stages (0.1.5-rc.2 went out 14:43-14:57 on 2026-09-10) npm resolved a
-      # mixed rc.1/rc.2 peer graph — 3062 ERESOLVE lines, then "Ineffective
-      # mark-compacts near heap limit" (exit 134), or a hard ETARGET on a
-      # sibling package that only appeared minutes later. Skipping peer
-      # negotiation keeps the install deterministic; the accumulated heap
-      # covers npm's worst case for this ~520-package tree. Mounting a
-      # version-mismatched bundle tree is not silent here: the mount smoke
-      # below boots the real shell and would fail loudly.
+      # The larger heap is the fix for one of the two ways this step used to
+      # die (runs 34490912649 and 34363627184 on the alpha line): the pinned
+      # version's TRANSITIVES are declared as floating `^` ranges, so while
+      # upstream publishes a prerelease in stages (0.1.5-rc.2 went out
+      # 14:43-14:57 on 2026-09-10) npm resolved a mixed rc.1/rc.2 peer graph —
+      # 3062 ERESOLVE lines, then "Ineffective mark-compacts near heap limit"
+      # (exit 134). The other failure mode was a hard ETARGET on a sibling
+      # package that appeared minutes later; pinning a version that is fully
+      # published (not mid-flight) is the fix for that one.
+      #
+      # Peer resolution stays ON: `--legacy-peer-deps` was tried in the first
+      # cut of this fix and made the install broken rather than robust — it
+      # skips exactly the peers a global install has to supply, and
+      # @deepseek-ai/dsh-app-boot requires `@deepseek-ai/cordis-plugin-group`
+      # (a peer, not a dependency) at boot, so the CLI died with
+      # ERR_MODULE_NOT_FOUND before the smoke could even start. Verified
+      # locally that the plain install resolves it.
       - name: Install dsh CLI (pinned)
         env:
           NODE_OPTIONS: --max-old-space-size=4096
-        run: npm install -g --legacy-peer-deps @deepseek-ai/dsh@0.1.5-rc.2
+        run: npm install -g @deepseek-ai/dsh@0.1.5-rc.2
 
       # lib/ is gitignored; the tarball is produced from this build.
       - name: Build and pack the npm tarball