feat(web): compose a web session's agent from a named preset

`session.create` takes an optional `agentPreset`, and the host resolves it,
mounts it during pre-publication setup, and records the resolved id on the
session header so a later resume rebuilds the same agent.

Resolution happens BEFORE the session exists, not inside setup: the session
boundary snapshots `meta` before asynchronous setup begins, so an id discovered
during setup could never reach the header. Mounting still happens in setup,
where a failure rolls the whole creation back rather than publishing a session
whose capabilities are half-installed.

Resume ignores whatever the request names and rebuilds from the stored id. A
resumed session's history was produced under that composition; restoring a
different one would replay tool calls the model can no longer make.

`dsh-agent-presets` now throws `UnknownPresetError` / `PresetMountError` so
the host can tell a bad request from a broken preset — they become
`agent-preset-not-found` and `agent-preset-invalid`.

Ships the two built-in compositions (`standard`, `core-web`) and the persona
row that lets them differ in identity. Nothing mounts them yet: no roster is
configured, so `composeAgent` finds no service and every session keeps the host
composition. Wiring the roster and moving base's agent-plane rows behind it is
the next commit, so the switch happens atomically with a real-composition test.

apps/cli/config/agent-presets/core-web/agent.cordis.yml

@@ -0,0 +1,31 @@
+# The `core-web` agent preset: the two-tool benchmark surface.
+#
+# The native model surface is exactly persistent `bash` plus
+# `str_replace_editor`. Everything else a session could reach — skills, goals,
+# plan mode, delegation, workflows, todo, web — is simply absent rather than
+# disabled, because a preset composes what an agent has instead of subtracting
+# from a shared default.
+#
+# The host composition is unchanged: this agent still runs inside the same
+# sandbox, approval, persistence, and model routing as any other session.
+
+- id: persona
+  name: '@deepseek-ai/dsh-persona'
+  config:
+    text: >-
+      You are a coding agent powered by the {{model}} model. Your working directory is {{cwd}}.
+
+# `tool-bash` provides the `bashEnv` service, so it needs a realm even alone.
+- id: shell
+  name: cordis:group
+  group: true
+  isolate:
+    bashEnv: true
+  config:
+    - id: tool-bash
+      name: '@deepseek-ai/dsh-tool-bash'
+
+- id: tool-str-replace-editor
+  name: '@deepseek-ai/dsh-tool-str-replace-editor'
+  config:
+    maxOutputChars: 16000