refactor: hoist the alpha.3 transitive peers into devDependencies

Replace the pnpm-workspace.yaml overrides with the plain-repo pattern:
install every peer the dev tree touches (dsh-attachment, dsh-code-runtime,
dsh-scope, dsh-session-projection, dsh-system-prompt, dsh-user-approval,
dsh-util-time) as direct devDependencies pinned to the baseline, same
as the thirteen already there. Root-level hoisting makes pnpm resolve
the peers natively (peers check: zero unmet, no global forcing), and
the list extends the existing bump workflow instead of introducing a
new mechanism.

Verified: typecheck clean, 107 test files / 1137 tests green, and the
real-host mount smoke passes 14/14 against @deepseek-ai/dsh@0.1.2-alpha.3.

pnpm-workspace.yaml

@@ -9,21 +9,13 @@ allowBuilds:
   protobufjs: true
 
 # The @deepseek-ai/* packages declare their dsh-* siblings as peerDependencies
-# (the DSH host bundle provides them all at mount time), but this repo installs
-# only a subset as direct devDependencies, so the remaining transitive peers
-# resolve to stale copies under pnpm — e.g. dsh-attachment 0.1.1-rc.1, which
-# predates the `admitPromptContent` export that dsh-subagent's artifacts
-# import. Pin those to the alpha line the upstream monorepo tests against.
-# This is a standing shim, not an upstream bug workaround: extend the list
-# (audit with `pnpm peers check`) whenever the DSH baseline is bumped.
-overrides:
-  '@deepseek-ai/dsh-attachment': 0.1.2-alpha.3
-  '@deepseek-ai/dsh-code-runtime': 0.1.2-alpha.3
-  '@deepseek-ai/dsh-scope': 0.1.2-alpha.3
-  '@deepseek-ai/dsh-session-projection': 0.1.2-alpha.3
-  '@deepseek-ai/dsh-system-prompt': 0.1.2-alpha.3
-  '@deepseek-ai/dsh-user-approval': 0.1.2-alpha.3
-  '@deepseek-ai/dsh-util-time': 0.1.2-alpha.3
+# (the DSH host bundle provides them all at mount time). This repo installs
+# every peer the dev tree needs as a direct devDependency pinned to the
+# baseline (see package.json), so pnpm resolves them instead of floating to
+# stale copies — e.g. dsh-attachment 0.1.1-rc.1 predates the
+# `admitPromptContent` export that dsh-subagent's artifacts import. When
+# bumping the DSH baseline, audit with `pnpm peers check` and hoist any
+# newly-unmet transitive peers into devDependencies too.
 
 minimumReleaseAgeExclude:
   - '@deepseek-ai/*'