Adapt companion and AT tooling to DSH 0.1.7-alpha.1

[mattheliu]

Candidate @oh-my-dsh/dsh-accessibility@0.1.2-alpha.1, with exact 0.1.7-alpha.1 DSH peers and lock graph. Uses the new conversation runtime and input-owned queue; isolates simultaneous Accessible View occurrences and IDs. Core CI baseline is the verified dsh-v0.1.7-alpha.1-a11y.2 tag.

Local validation: host/client types and builds; 234 tests in 28 files; packed npm artifact; five external-plugin assembled checks including Chromium/Firefox/WebKit; companion/core lab startup and cleanup plus all six live-lab scenario startup/cleanup checks. Complete core Web replay passed 486 tests with 15 conditional skips; GUI passed 7,396 with 1 skip. The compatibility record distinguishes initial failures from final passes.

Preserves the existing human campaign and evidence ledger. New core/live launchers enforce the current exact version and selected fixture generation, but smoke readiness is NOT a VoiceOver/NVDA or disabled-user observation. No npm publication yet; README explicitly marks the candidate unpublished and keeps the historical installation baseline separate. Alpha publishing routes only to the alpha dist-tag, not latest.

Follow-up validation (2026-09-22): core 41074ff082 repairs retired Windows test paths, upstream-only Project credentials, test unknown casts, and the migrated heartbeat fixture idle window. 124 focused tests passed; the final terminal recheck passed 20 tests and the corrected heartbeat scenario passed. Static rehearsal passed 57 gates; its two failed gates passed individual rechecks after repair. Prior full GUI/Web/browser results above belong to b11b37b065. The first companion remote run passed all six OS/Node matrix jobs and assembled checks. New exact-revision remote CI is pending; do not treat it as passed or publish yet. Real assistive-technology evidence remains pending.

[mattheliu]

Pre-merge audit (2026-09-22): inspected tracked text in both workspaces (13,153 core files and 175 companion files), the additions in 39 core and 7 companion commits relative to the PR bases, and the companion npm dry-run inventory (126 files, including its generated source map). No real credentials, personal machine paths, or private intranet addresses were found in the adaptation changes or candidate package. Scanner hits in existing source were synthetic security-test inputs or unchanged upstream examples; this is a scoped review, not a comprehensive security certification.

Current-revision local checks: core 41074ff082 + companion ae689cd passed the five assembled browser tests (Chromium, Firefox, WebKit); 76 focused privacy/evidence/reading-view checks passed. Repositories are clean. These runs use synthetic/replayed conversations, not live-provider, VoiceOver/NVDA, or disabled-user evidence. Raw lab readiness logs are not public evidence and are not included in the npm package.

No npm publication is authorized by this merge step. Preserve the pending human-AT status and historical evidence versions.