feat(cli): even out the shipped tool rosters across both surfaces

The two shipped surfaces offered different tools for no recorded reason:
session checkpoints, tool-result pruning, the goal tools, and Ralph were in
`tui.cordis.yml`; `tool-todo` and web search were in `web.cordis.yml`. Neither
offered session search, a string-replacement editor, or a repeat-tool guard,
though none of the three is surface-specific.

Move the rows that are not surface-specific into `base.cordis.yml` and add
those three. Web search moves there too — the TUI decision the change that
made it a Web default deferred. Both surfaces now assemble the same 27 tools.

This adds only. No row is removed from either surface and no existing row's
configuration is edited: executors, sandbox composition, access defaults,
`tools.mode`, and the workflow tool are exactly what they were. Two rows stay
surface-specific: `tmux-context` (no terminal multiplexer in a browser) and
`session-reference` (its index has one writer owner).

Ship `dsh-mcp-client` as a dependency without a row: the plugin mounts one
server per instance and `command` is required, so a default would name a
third-party server and spawn it outside `ctx.bash` on every launch. The CLI
README carries the YAML for mounting one from a personal config.

apps/cli/composition.md

@@ -96,6 +96,28 @@ flowchart LR
   cfg --> plugin_tui_spill_local
   plugin_tui_spill_policy["spill-policy<br/>@deepseek-ai/dsh-spill-policy"]
   cfg --> plugin_tui_spill_policy
+  plugin_tui_session_checkpoint_policy["session-checkpoint-policy<br/>@deepseek-ai/dsh-session-checkpoint-policy"]
+  cfg --> plugin_tui_session_checkpoint_policy
+  plugin_tui_tool_result_prune["tool-result-prune<br/>@deepseek-ai/dsh-compact-tool-result-prune"]
+  cfg --> plugin_tui_tool_result_prune
+  plugin_tui_tool_todo["tool-todo<br/>@deepseek-ai/dsh-tool-todo"]
+  cfg --> plugin_tui_tool_todo
+  plugin_tui_tool_goal["tool-goal<br/>@deepseek-ai/dsh-tool-goal"]
+  cfg --> plugin_tui_tool_goal
+  plugin_tui_tool_ralph["tool-ralph<br/>@deepseek-ai/dsh-tool-ralph"]
+  cfg --> plugin_tui_tool_ralph
+  plugin_tui_tool_session_query["tool-session-query<br/>@deepseek-ai/dsh-tool-session-query"]
+  cfg --> plugin_tui_tool_session_query
+  plugin_tui_tool_str_replace_editor["tool-str-replace-editor<br/>@deepseek-ai/dsh-tool-str-replace-editor"]
+  cfg --> plugin_tui_tool_str_replace_editor
+  plugin_tui_repeat_tool_guard["repeat-tool-guard<br/>@deepseek-ai/dsh-repeat-tool-guard"]
+  cfg --> plugin_tui_repeat_tool_guard
+  plugin_tui_web["web<br/>@deepseek-ai/dsh-web"]
+  cfg --> plugin_tui_web
+  plugin_tui_web_search_deepseek["web-search-deepseek<br/>@deepseek-ai/dsh-web-search-deepseek"]
+  cfg --> plugin_tui_web_search_deepseek
+  plugin_tui_tool_web["tool-web<br/>@deepseek-ai/dsh-tool-web"]
+  cfg --> plugin_tui_tool_web
   plugin_tui_tools["tools<br/>@deepseek-ai/dsh-tools"]
   cfg --> plugin_tui_tools
   plugin_tui_system_prompt["system-prompt<br/>@deepseek-ai/dsh-system-prompt"]
@@ -154,6 +176,17 @@ flowchart LR
 | `timeout-policy` | `@deepseek-ai/dsh-timeout-policy` |
 | `spill-local` | `@deepseek-ai/dsh-spill-local` |
 | `spill-policy` | `@deepseek-ai/dsh-spill-policy` |
+| `session-checkpoint-policy` | `@deepseek-ai/dsh-session-checkpoint-policy` |
+| `tool-result-prune` | `@deepseek-ai/dsh-compact-tool-result-prune` |
+| `tool-todo` | `@deepseek-ai/dsh-tool-todo` |
+| `tool-goal` | `@deepseek-ai/dsh-tool-goal` |
+| `tool-ralph` | `@deepseek-ai/dsh-tool-ralph` |
+| `tool-session-query` | `@deepseek-ai/dsh-tool-session-query` |
+| `tool-str-replace-editor` | `@deepseek-ai/dsh-tool-str-replace-editor` |
+| `repeat-tool-guard` | `@deepseek-ai/dsh-repeat-tool-guard` |
+| `web` | `@deepseek-ai/dsh-web` |
+| `web-search-deepseek` | `@deepseek-ai/dsh-web-search-deepseek` |
+| `tool-web` | `@deepseek-ai/dsh-tool-web` |
 | `tools` | `@deepseek-ai/dsh-tools` |
 | `system-prompt` | `@deepseek-ai/dsh-system-prompt` |
 | `agent-loop` | `@deepseek-ai/dsh-agent-loop` |