DSH: preserve profiles, skills, plugins and extension recovery

## 目标

在 cindy-managed 与 user-selected existing DSH Home 之间提供可恢复的配置路径，同时将 Cindy internal MCP 与 runtime/user configuration 隔离。

## 交付

- Home-mode setting/projection/recovery；无 credential copy、删除或强制重装。
- Main-only internal MCP factory、allowlist、token/lease/generation/account cleanup。
- 仅通过已测试 runtime/Cindy operation 暴露 profile/skill/plugin/extension discovery 与 explicit install/update/enable/disable/self-repair。

## 验收

- 安全提示不形成不可逆的用户 operation lockout。
- internal MCP 无 runtime configuration authority；secret/header/command 不泄露。

Blocked by #3776. Blocks #3779.

Canonical plan: `docs/issues/dsh-native-integration/`.

Start with docs/issues/dsh-native-integration/ and review blocking issue #3776 before identifying the relevant runtime and Cindy-operation entry points. Confirm the existing DSH Home modes and tested operations, then verify completion against recovery without credential changes, internal MCP isolation, and safe discovery, installation, updating, enabling, disabling, and self-repair.

Written by the indexing model from the issue text.