feat(dsh-sdk): create <source> — add external plugin as native PM dependency + cordis mount

dsh-sdk create <source> adds a github (github:owner/repo#ref) or npm (pkg@version)
plugin as a package-manager-native dependency, then mounts the resolved dependency
in cordis.yml through ProjectEditSession. Adds PackageManager.add(spec) and
ProjectEditSession.addExternalPlugin(id, packageName). No giget/pacote. Per-file
100% coverage on the new/changed files.

packages/sdk/scripts/src/args.ts

@@ -8,12 +8,13 @@ import { parseArgs as parseNodeArgs } from 'node:util'
 import { Command } from 'commander'
 
 /** Commands implemented by the dsh-sdk launcher. */
-type DshSdkCommand = 'start' | 'dev' | 'build' | 'config'
+type DshSdkCommand = 'start' | 'dev' | 'build' | 'config' | 'create'
 
 /** Parsed dsh-sdk invocation. */
 export interface DshSdkArgs {
   command?: DshSdkCommand
   target?: string
+  source?: string
   forwarded: readonly string[]
   help: boolean
 }
@@ -60,6 +61,9 @@ export function parseDshSdkArgs(argv: readonly string[]): DshSdkArgs {
   program.command('config').helpOption(false).action(() => {
     parsed = { command: 'config', forwarded: [], help: false }
   })
+  program.command('create <source>').helpOption(false).action((source: string) => {
+    parsed = { command: 'create', source, forwarded: [], help: false }
+  })
   program.parse([...launcherArgv], { from: 'user' })
   /* v8 ignore next -- every registered Commander action above assigns parsed or Commander throws */
   if (!parsed) throw new Error('dsh-sdk command did not resolve')