DSH: prove the Cindy-owned bridge gate

## Purpose

Prove one reviewed DSH release can be controlled by a **Cindy-owned** control plane over public ACP v1. This work does not depend on an upstream Native Host API and must not use private JSONL/DB scraping or Web UI driving.

## Current F0 evidence (2026-09-02)

- The secret-free darwin-arm64 alpha.3 packet pins the wheel filename, SHA-256, archive tree, sidecars, SDK lifecycle, and public ACP initialize/new/close/list/resume lifecycle.
- `DshControlPlane`, `DshAcpClient`, and Desktop Main ACP stdio transport now form an unregistered, Main-owned bridge. It enforces scope/session ownership, fixed ACP launch arguments, absolute managed launch paths, receipt correlation, EOF/exit fail-close behaviour, and explicit close-then-resume semantics.
- A real fixed-binary E2E exercised create -> close -> list/reconcile -> resume -> idle cancel -> close, plus prompt -> public `session/update` follow -> running-turn cancel -> `stopReason: cancelled` using a temporary loopback fake provider. No user credential, user profile, or external endpoint was used.
- The bridge whitelists only the currently proven prompt terminal states `end_turn` and `cancelled`. The follow assertion proves the public ACP wire and bridge drive; it does **not** claim F4 product event projection, permission UI, remote, Mobile, or durable recovery.
- The ACP stdout carrier was audited and repaired: byte-counted framing now rejects an oversized unterminated child record before UTF-8/full-line allocation, fail-closes the bridge, and terminates the child. Targeted unit tests, Desktop typecheck, real-binary E2E, documentation checks, and a post-repair security diff scan passed with zero remaining findings.

## Gate result

The exact alpha.3 packet is structurally valid and its runtime/ACP checks pass, but the gate remains **INCOMPLETE** for exactly one reason: the downloaded wheel has no verifiable wheel-to-source binding. The GitHub tag is lightweight and the release has no assets; the wheel metadata does not bind it to a source commit. This is a release-provenance blocker, not a missing upstream Host API.

## Remaining F0 acceptance condition

- Obtain and record a reviewer-verifiable wheel-to-source attestation for this exact release, or adopt a maintained, explicitly reviewed release-provenance policy that can verify this exact wheel without weakening the gate.

Until that condition is met, DSH remains unregistered: no product `AgentKind`, UI, remote, Mobile, or system-prompt rollout may begin. F2/F3/F4 onward own their separate managed-runtime, durable-recovery, permission/event-projection, and cross-surface gates after F0 passes.

## Validation

- `node --test scripts/__tests__/dsh-native-host-gate.test.mjs`
- `pnpm --filter desktop exec vitest run src/main/maker-host/__tests__/dshAcpStdioTransport.test.ts src/main/maker-host/__tests__/dshControlPlane.test.ts`
- `pnpm exec vitest run packages/maker-core/src/agents/dsh/acp-client.test.ts`
- `pnpm --filter desktop typecheck`
- real alpha.3 bridge E2E with the release-pinned executable and temporary loopback provider
- post-repair Codex Security diff scan: 13 source/test/gate files reviewed, 0 findings

Dependency: blocks F1. Parent: #3770.

Start with scripts/__tests__/dsh-native-host-gate.test.mjs and the listed DSH bridge tests to understand the current gate and validation. Investigate how the alpha.3 wheel can be tied to its source, then provide a reviewer-verifiable attestation or an explicitly reviewed provenance policy. Done means the exact release passes the remaining provenance condition and the F0 gate is complete.

Written by the indexing model from the issue text.