feat: adapt accessibility companion to DSH 0.1.7-rc.2

[mattheliu]

Summary

Prepare unpublished companion 0.1.2-rc.1 for exact npm DSH 0.1.7-rc.2 (current latest), keeping 0.2.0-rc.1 (next) separate.

Core migration: omdsh-dev/deepseek-harness#5

• Pin all DSH peers/development packages exactly, align Cordis to 4.0.4, and explicitly supply the upstream boot group's 1.0.4 dependency.
• Retarget package/version tests and lab preflight without version exemptions.
• Pin assembled CI to clean accessibility core 1e53eedb532a7965aee4d4c294c2ee313cf15906; update bilingual core/live lab setup and compatibility records.
• Preserve historical npm instructions, versioned evidence, and the original human campaign; explicitly label this new candidate as unpublished.

Verification

• Host/client type checks, peer check, build, 236 tests in 28 files, evidence schema validation, and npm dry pack passed.
• Local tarball installed through the real DSH CLI into a disposable home, followed by a boot-free Web configuration dump. No model call or user-profile migration.
• 5 assembled tests passed across Chromium, Firefox, and WebKit with clean core 1e53eedb532a7965aee4d4c294c2ee313cf15906 and companion 20b3b151858d9b9e6cb986501c00faf6960eb1b6. Later companion changes are documentation-only.
• Core/companion/live AT labs each passed bounded startup/cleanup smoke on the same revisions; this is not actual screen-reader validation or live replay consumption.
• An isolated private 0.2.0-rc.1 experiment passed the 236 package/API tests, types, build, and peer checks. No migrated core, assembled browser, or human support claim for that preview.
• Candidate package pattern scan found no credential-shaped strings, private keys, or local home paths; not a full security audit.

See COMPATIBILITY-0.1.7-rc.2.md / .zh.md for core regression results and limitations, including partitioned Web checks and an earlier GUI timeout followed by a clean full pass.

Boundaries

Depends on the rc.2 accessibility-core PR and its designer/product review. Keep unmerged until review and remote CI complete. No npm publication, no new support tag, and no claim of whole-product accessibility. Real VoiceOver/NVDA and disabled-developer evidence stays pending.