feat(cli): dsh integration — config dsh + skills sync --agent dsh

dsh (the DeepSeek harness) joins claude, pi, prime-agent and opencode as
a first-class host. `mcpctl config dsh --project X`:

- merges ONE dsh-mcp-client entry (id mcp-mcpctl, mount name mcpctl,
  stdio bridge `mcpctl mcp -p X`) into the profile's user patch layer
  (~/.dsh/profiles/<profile>/cordis.patch.yml). The stdio bridge keeps
  auth in ~/.mcpctl/credentials — the patch file is 0644 and commonly
  committed to dotfiles, so the HTTP mount's bearer header is not an
  option there.
- edits with the comment-preserving `yaml` Document API and touches only
  its own entry: dsh appends runtime UI state to the same file, bundles
  and users own the rest, and a corrupt or non-array file aborts instead
  of being overwritten. Re-runs re-point the bridge args in place and
  keep user-added keys; a same-mount entry under another id is adopted,
  a hand-configured server with its own serverName is never touched.
- writes the .mcpctl-project marker with the prime-agent semantics and
  syncs skills into ~/.dsh/skills — the user root dsh-skill-filesystem
  scans AND watches, so synced skills appear without a restart. `dsh`
  becomes a skills sync target with the shared-tree semantics, state in
  ~/.mcpctl/skills-state-dsh.json.

Verified against dsh 0.2.0-rc.2: the web profile boots, spawns the
bridge as its child within a second, and serves with the mount active;
patch-file comments and dsh's own appended entries survive re-runs.
Completions regenerated for the new subcommand.

Note: tests/commands/prime-agent.test.ts ("does not write a marker when
run from $HOME") fails on main too on this machine and leaks a real
~/.mcpctl-project — pre-existing test-isolation issue, untouched here.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V6HNx6cyr4J4CiMGCy1wkF

README.md

@@ -252,6 +252,37 @@ Re-sync skills on their own with
 
 See [docs/opencode-extension.md](docs/opencode-extension.md) for full details.
 
+### Connect dsh (DeepSeek harness)
+
+dsh has a native MCP client, configured through a profile's user patch layer
+(`~/.dsh/profiles/<profile>/cordis.patch.yml`). mcpctl mounts the same stdio
+bridge there that `config claude` registers — auth stays in
+`~/.mcpctl/credentials`, nothing secret lands in the patch file:
+
+```bash
+mcpctl config dsh --project monitoring            # the `web` profile
+mcpctl config dsh --project monitoring --profile cli
+```
+
+This merges a single `dsh-mcp-client` entry (id `mcp-mcpctl`, mount name
+`mcpctl`, bridge `mcpctl mcp -p monitoring`) into the patch file with a
+comment-preserving editor — every other entry, comment and runtime-appended
+block survives — writes a `.mcpctl-project` marker, and syncs skills into
+`~/.dsh/skills/` (dsh watches that root, so skills appear without a restart;
+the MCP mount itself is picked up on the next dsh start). Re-running with a
+different project re-points the existing entry in place.
+
+```bash
+mcpctl config dsh --project monitoring --skip-skills   # don't sync skills
+mcpctl config dsh --project monitoring --skip-marker   # don't touch .mcpctl-project here
+mcpctl config dsh --project monitoring --dry-run       # print the plan, write nothing
+```
+
+Re-sync skills on their own with
+`mcpctl skills sync --agent dsh --project monitoring`.
+
+See [docs/dsh-integration.md](docs/dsh-integration.md) for full details.
+
 ### Run Claude Code on the homelab LLM
 
 The homelab gateway (LiteLLM in front of vLLM) already serves the Anthropic