refactor: brand the command lifecycle pairing id as CommandId

commandId crosses three boundaries (session log, wire admission response,
client flow pairing), so per the branded-id rule it becomes
Branded<'CommandId'>, declared in a new pure @deepseek-ai/dsh-commands/brand
outlet (the dsh-llm/brand shape: type + constructor, no Context merges, so
wire and client programs can name it without loading the host plugin). The
event payloads, CommandExecution, and the executor mint carry the brand; the
wire schema gains commandIdSchema as the domain's single brand-cast point
(the approvals precedent); CommandNode and the fixture's fabrication cast
follow type-only.

packages/client/runtime/src/client/sessions/conversation.ts

@@ -3,6 +3,7 @@
 // substructures keep their references (the React.memo premise). callId/approvalId stay plain
 // string here (narrow to real brands when convenient).
 
+import type { CommandId } from '@deepseek-ai/dsh-commands/brand'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
 import type { TodoItem } from '@deepseek-ai/dsh-session/types'
 import type {
@@ -136,7 +137,7 @@ export interface CommandNode {
   /** Unix epoch ms of the anchoring event. */
   time: number
   /** Pairing id minted by the host executor. */
-  commandId: string
+  commandId: CommandId
   /** Command name (run payload's structured field); null when the run fell outside the window. */
   name: string | null
   /** Verbatim rawInput after the name, separator whitespace included (run payload); null when the run fell outside the window. */