fix(deepseek): atomic shim write, honest attribution comment, name-fallback profile classifier

The three smaller review nits, plus the first real test coverage for the status
shim (it had none: it is emitted as a STRING, so tsc never sees it).

1. The shim was written with a plain writeFileSync. The TUI can be exec'ing that
   exact path while an upgraded Codeman refreshes it, and a reader catching a
   half-written file gets a syntax error, exits non-zero, and is retried four
   times per state change for a file that will never parse. Now temp + rename
   (atomic within the directory), with the temp chmod'ed before the rename since
   writeFileSync's mode only applies on create, and removed if the write throws.
   SHIM_VERSION bumped to 2, because SHIM_SOURCE changed and an existing v1 shim
   would otherwise keep matching the embedded marker and never be refreshed.

2. The pane-id comment claimed the ambient env "cannot be spoofed by an argument
   the agent itself could influence". The agent runs IN that pane and can invoke
   the shim with CODEMAN_SESSION_ID unset and any argv it likes. It buys nothing
   it did not already have (the hook-secret file is readable from the same pane,
   so it can POST /api/hook-event directly), but the comment read like a security
   boundary. Rewritten to say what the preference actually buys: correct
   attribution when a TUI mangles or re-uses the pane argument. Accidents, not
   adversaries.

3. classifyProfile() folded the directory name into the same haystack as the
   bundles, but only the TUI arm could match a bare name, so a stock profile
   whose package.json has no dsh.profile.bundles (hand-edited, older layout,
   mid-install) classified as `unknown` -> launchable -> eligible as the DEFAULT
   pick, which is exactly the pane-dies-on-arrival failure the two-part
   availability gate exists to prevent. The stock names are now a LAST-resort
   fallback consulted after the bundle patterns, so real bundle evidence still
   wins over a name the user chose. The loose `tui` arm gained word boundaries:
   it decides which profile boots by default, and matching the middle of
   `intuition` is not a rule anyone could predict.

New test/deepseek-status-shim.test.ts runs the generated script the way the
harness does -- real node process, real argv, real env, real listener -- and
covers the exit-code contract that makes the retry behaviour safe: mapped states
post and exit 0, an unknown verb or unmapped state exits 0 WITHOUT posting (a
non-zero there would be four HTTP requests per state change forever), a rejecting
server or an unreachable one exits non-zero so the caller retries, the hook secret
is read at execution time, and `node --check` parses the file (a template-literal
typo in SHIM_SOURCE is invisible to tsc).

Trap worth recording, hit while writing it: the tests must spawn the shim
ASYNCHRONOUSLY. The listener lives in the test process, so spawnSync blocks the
event loop that has to accept the connection, the shim waits out its own 1500ms
socket timeout and exits 1, and it reads exactly like a broken shim (measured:
Socket._onTimeout in its --trace-exit output, server logging nothing).

Verified: full gate green (6142 passed, +10), typecheck/lint/format clean.

test/deepseek-cli-resolver.test.ts

@@ -224,6 +224,51 @@ describe('DeepSeek profile inventory', () => {
     expect(resolveDefaultDeepSeekProfile()).toBe('custom');
   });
 
+  it('does not treat a bundle-less stock profile as launchable', () => {
+    // readProfile() yields an empty bundle list for any package.json without a
+    // `dsh.profile.bundles` array (hand-edited, older layout, mid-install), and
+    // with no bundles to read the shipped web/headless profiles used to look
+    // exactly like an unrecognized third-party one — inheriting its
+    // launchable-by-default treatment and producing the pane-dies-on-arrival
+    // failure the two-part availability gate exists to prevent.
+    const bare = (name: string) => {
+      const dir = join(home, 'profiles', name);
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(join(dir, 'package.json'), JSON.stringify({ name: `dsh-profile-${name}` }));
+    };
+    bare('web');
+    bare('headless');
+
+    const profiles = listDeepSeekProfiles();
+    expect(profiles.map((p) => `${p.name}:${p.kind}`).sort()).toEqual(['headless:headless', 'web:web']);
+    expect(profiles.every((p) => !isLaunchableProfile(p))).toBe(true);
+    expect(resolveDefaultDeepSeekProfile()).toBeNull();
+  });
+
+  it('lets bundle evidence beat the name fallback', () => {
+    // The name check is a LAST resort, so a profile the user happened to call
+    // `web` that really composes a terminal app is still interactive. Otherwise
+    // a directory name would override what the profile actually contains.
+    writeProfile('web', ['@deepseek-ai/dsh-base', '@someone/dsh-tui']);
+    const profile = listDeepSeekProfiles().find((p) => p.name === 'web')!;
+    expect(profile.kind).toBe('interactive');
+    expect(resolveDefaultDeepSeekProfile()).toBe('web');
+  });
+
+  it('does not read `tui` out of the middle of an unrelated word', () => {
+    // The loose arm is a TOKEN match: `@someone/tui-app` is a TUI, `intuition`
+    // is a word. Being wrong is cheap (unknown is launchable too) but it decides
+    // which profile boots by DEFAULT, and "its name contains t-u-i" is not a
+    // rule anyone could predict.
+    writeProfile('intuition', ['@someone/gratuitous-surface']);
+    expect(listDeepSeekProfiles().find((p) => p.name === 'intuition')!.kind).toBe('unknown');
+
+    writeProfile('mine', ['@someone/tui-app']);
+    expect(listDeepSeekProfiles().find((p) => p.name === 'mine')!.kind).toBe('interactive');
+    // Preferred over the merely-unknown one, which is the whole point of ranking.
+    expect(resolveDefaultDeepSeekProfile()).toBe('mine');
+  });
+
   it('survives a stray directory under profiles/', () => {
     mkdirSync(join(home, 'profiles', 'not-a-profile'), { recursive: true });
     writeProfile('dsh-tui', ['@deepseek-harness-tui/dsh-tui']);