refactor(cli): simplify profile composition and dump paths

- composeProfile keeps layers as bundle/user/overlay+flags segments instead
  of one flat list later re-sliced by index arithmetic; the row index drops
  the group-walk (profile trees are flat patch compositions) and the double
  composition.
- The config dump anchors on the profile's real empty root (written by the
  shared prepareProfile) instead of materializing a temp file, so dump and
  boot compose over the identical base by construction.
- dsh-base drops its patchPath export: the dsh.patch manifest field is the
  one contract; the package carries no runtime API.
- packageDirFromAnchor is paths-probe only (the require.resolve fast path
  duplicated the probe's outcome); basename() replaces hand-rolled path
  splitting; verify-cordis-config stops re-reading bundle manifests in-loop.

packages/bundle/base/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/bundle/base/README.md
-README.md: dd44e825f9a62c8b5e49a6af31c17b242a1927d7
-README.zh.md: 7227345591b5ddf6d27a88038074ed3541b01102
+README.md: 627dddc3808f67a2624e6e5b4d7f71c1617f227a
+README.zh.md: 84f48357d7b66df334d9f78eff64b0c7de3080e1