refactor(agents): link dsh shared policy as a home-layer patch (#388)

dsh rewrites a profile's cordis.patch.yml at runtime, so linking the web
profile put GUI state in the checkout and let runtime writes clobber manual
edits. Link the stable policy as the $DSH_HOME home layer instead: dsh applies
it after every profile and only reads it.

The host-plane compaction-basic row is disabled on the web surface and each
agent preset owns its own copy, so the top-level override was inert. Drop it;
the model contextWindow/maxTokens are the effective knobs.

- add home/base/tui/agents/dsh/cordis.patch.yml, linked from default.nix
- drop the ~/.dsh/profiles/web link and the tracked web/ profile
- keep runtime state and private/local model routes in the profile patch
- update the eval test and README

home/base/tui/agents/README.md

@@ -13,8 +13,8 @@ Nix dependency; this module only wires it into place.
 - `packages.nix`: agent CLIs (`codex`, `opencode2`, `pi`) from the `llm-agents` flake input, plus
   `pkgs.mcp-grafana` for the Grafana MCP server.
 - `env.nix`: telemetry and auto-update opt-outs for the agents.
-- `dsh/`: the dsh `web` profile that lives in `~/.dsh`. See [dsh/README.md](./dsh/README.md) for the
-  link granularity, the tracked members and which hosts import it.
+- `dsh/`: the shared dsh home-layer patch linked to `~/.dsh/cordis.patch.yml`. See
+  [dsh/README.md](./dsh/README.md) for why the shared layer is linked and the profile patch is not.
 
 ## Deployed rule targets