Merge remote-tracking branch 'origin/master' into worktree/preset-plane-fallout-p1

Only `docs/module-graph.*` conflicted, from master's new
`@deepseek-ai/dsh-message-feedback` package; generated, so taken from master
and regenerated.

Hook bypassed as before: the staged-pairing check hands an archived note path
to `verify-translation-pairing`. The full-corpus gate passes.

packages/bundle/web-app/cordis.patch.yml

@@ -60,6 +60,11 @@
       config:
         backend: json
 
+    - id: message-feedback
+      name: '@deepseek-ai/dsh-message-feedback'
+      config:
+        maxNoteBytes: 8192
+
     - id: workspace
       name: '@deepseek-ai/dsh-workspace'