refactor(cli): simplify profile composition and dump paths

- composeProfile keeps layers as bundle/user/overlay+flags segments instead
  of one flat list later re-sliced by index arithmetic; the row index drops
  the group-walk (profile trees are flat patch compositions) and the double
  composition.
- The config dump anchors on the profile's real empty root (written by the
  shared prepareProfile) instead of materializing a temp file, so dump and
  boot compose over the identical base by construction.
- dsh-base drops its patchPath export: the dsh.patch manifest field is the
  one contract; the package carries no runtime API.
- packageDirFromAnchor is paths-probe only (the require.resolve fast path
  duplicated the probe's outcome); basename() replaces hand-rolled path
  splitting; verify-cordis-config stops re-reading bundle manifests in-loop.

apps/cli/src/dump-config.ts

@@ -6,17 +6,14 @@
  * @module @deepseek-ai/dsh/dump-config
  */
 
-import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
+import { existsSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import {
-  healProfilesModuleFallback,
   loadOverlayPatches,
-  loadProfile,
   renderConfigDump,
   type ConfigDumpLayer,
 } from '@deepseek-ai/dsh-app-boot'
-import { INSTALL_ANCHOR } from './profile-boot.ts'
+import { prepareProfile, PROFILE_ROOT_FILENAME } from './profile-boot.ts'
 
 const NAME = 'dsh'
 
@@ -24,15 +21,13 @@ const NAME = 'dsh'
 /**
  * Print a profile composition with provenance comments.
  * @param profile - the profile name.
- * @param defaultOnly - omit the profile's user layer and `--patch` overlays.
+ * @param defaultOnly - omit the profile's user layer and `--patch` overlays
+ * (the recovery diagnostic for a broken `cordis.patch.yml`, which is then
+ * never parsed).
  * @param patches - `--patch` overlay paths, in argv order.
  */
 export function runDumpConfig(profile: string, defaultOnly: boolean, patches: readonly string[]): void {
-  healProfilesModuleFallback(INSTALL_ANCHOR)
-  // The default dump never reads the user layer: it doubles as the recovery
-  // diagnostic for a broken cordis.patch.yml, so parsing that file here would
-  // defeat its purpose.
-  const loaded = loadProfile(NAME, profile, INSTALL_ANCHOR, undefined, { userLayer: !defaultOnly })
+  const loaded = prepareProfile(profile, !defaultOnly)
   const layers: ConfigDumpLayer[] = loaded.layers.map(layer => ({
     label: layer.packageName,
     patches: layer.patches,
@@ -46,15 +41,7 @@ export function runDumpConfig(profile: string, defaultOnly: boolean, patches: re
       layers.push({ label: absolute, patches: loadOverlayPatches(NAME, absolute) })
     }
   }
-  // renderConfigDump anchors on a base entry-list file; a profile's base is
-  // the empty list, materialized as a temp document.
-  const emptyRoot = mkdtempSync(join(tmpdir(), 'dsh-dump-'))
-  const emptyRootFile = join(emptyRoot, 'profile-root.yml')
-  writeFileSync(emptyRootFile, '[]\n')
-  try {
-    process.stdout.write(renderConfigDump(NAME, emptyRootFile, layers))
-  } finally {
-    rmSync(emptyRoot, { recursive: true, force: true })
-  }
+  // The dump anchors on the same empty root file the boot includes.
+  process.stdout.write(renderConfigDump(NAME, join(loaded.dir, PROFILE_ROOT_FILENAME), layers))
 }
 /* v8 ignore stop */