fix: recover from incompatible user plugins on startup

[KuthorX]

Summary

• expand Harness AggregateError logging so nested loader-entry failures remain visible
• detect verified host/plugin API incompatibilities only for packages installed in the user web profile
• disable incompatible entries in the real user cordis.patch.yml and sync .dsh-market/state.json
• retry startup once, then show a native Desktop notice listing the disabled plugins
• require the Harness entry-loaded marker as well as HTTP readiness to avoid transient startup races

Root cause verified

• dsh-inline-images: service "inlineImages" has been registered
• focus / dsh-plugin-focus: unsupported JSON schema: schema.required is not supported by the value schema DSL
• both failures were hidden behind the top-level AggregateError: loader entries failed to apply

User-visible behavior

• Desktop automatically disables the incompatible plugins and recovers startup
• Plugin Market shows both switches off and reports patch disabled
• Desktop displays a native notice naming the plugins and asks the user to update them before re-enabling

Safety

• built-in plugins are excluded by requiring a matching package manifest under $DSH_HOME/profiles/web/node_modules
• only the two verified compatibility failure classes trigger recovery
• ordinary startup failures such as missing user configuration are not auto-disabled
• patch text is appended without parsing/stringifying, preserving comments and !!js expressions
• market groups/order are preserved; invalid market state is never overwritten
• recovery retries at most once

Verification

• npm run typecheck
• npm run build
• npm test (16 files, 85 tests)
• subprocess integration covers a transient HTTP-ready state followed by plugin load failure
• packaged macOS build tested against the real profile with both plugins enabled:
  • first attempt reports both verified incompatibilities
  • Desktop writes disabled: true for loader ids and both package names to market state
  • second attempt reaches DSH entry loaded without a recovery patch argument
  • native recovery notice lists both plugins
  • Plugin Market shows dsh-inline-images and dsh-plugin-focus disabled with switches off

[yaojin3616]

Thanks for working on this!

We have recently implemented a comprehensive startup recovery and plugin lifecycle architecture (via #147, #148, and related recovery enhancements):

1. Interactive Recovery UI: When Harness fails to boot, Desktop displays an interactive recovery view that dynamically pinpoints the offending plugin(s) across all error classes (slot/scope conflicts, missing dependencies, broken bundle imports, schema errors) rather than matching specific error strings.
2. Complete Uninstallation & Cleanup: Instead of muting plugins via disabled: true in cordis.patch.yml (which leaves packages and bundle inserts in package.json / node_modules), Desktop now performs clean uninstallation (pruning plugin rows from cordis.patch.yml via AST parsing, removing from dependencies / bundles / node_modules / packages, and clearing stale lockfiles).
3. Boot-time Profile Healing: Features like ensureStoreDirPinned, pruneMissingProfileBundles, and profile package repair are now built directly into the launch lifecycle.

Since the unified recovery mechanism supersedes this approach, we will close this PR. Thanks again for your contribution!