fix(market): expose packaged pnpm services

[citizenll]

Summary

• expose generation-scoped desktopProfiles and desktopPnpm services from the built-in market installer
• make the dsh-market Loader entry wait for desktopProfiles, so compatible releases deterministically select their Desktop adapter
• route both dsh-market operations and the fixed install/uninstall endpoints through the same packaged Node/pnpm boundary, with one-operation gating, cancellation, and teardown

Root cause

#61 made the bundled pnpm executable available, but availability and integration are different layers. dshmarket >= 1.6.0 only bypasses system package-manager probing when the Host exposes desktopProfiles and desktopPnpm. Without those services it takes the ordinary DSH path and probes the GUI process's ambient PATH, which is unreliable on Windows and macOS launches.

This change fixes the Host contract instead of detecting or modifying npm/pnpm/yarn/bun installations on the user's machine. DSH profile mutations keep using the app's pinned pnpm, preserving its lockfile and reconciliation semantics.

Upgrade and startup analysis

Risk is low for existing installations:

• no profile, manifest, dependency, or lockfile migration is performed at startup
• no user/system environment variable or package-manager installation is changed
• startup only prepares the same private Node/pnpm shims already introduced by fix(market-installer): ensure bundled Node and pnpm runtimes are used for plugin installation #61; it does not run a package mutation
• installed dshmarket >= 1.6.0 switches to its supported Desktop path on the next Harness generation while keeping the existing web profile directory
• older market releases retain the existing process-scoped shim fallback
• users without dsh-market retain the fixed-target installer behavior
• all package mutations share one generation-scoped gate and active work is cancelled and awaited during teardown

The main behavioral change is intentional: compatible market releases no longer inspect or provision a system package manager.

Validation

• npm run typecheck
• npm test — 26 files, 167 tests passed
• npm run build
• real Harness smoke test against an existing persisted dshmarket@1.15.0 profile: /dsh-market/status returned pnpm: true, restart: false
• dsh --dump-config confirmed the composed dsh-market row waits for desktopProfiles

Closes #53
Addresses #56