DSH: execute complete Cindy scopes on SSH remotes

## 目标

在远端运行完整 Cindy DSH scope：runtime、DSH_HOME、workdir、files、terminal、MCP 与 recovery 均为 remote-owned。

## 交付

- remote runtime installer/probe/manifest、Home、Cindy bridge launch、authenticated forward、health/teardown。
- one-scope reconnect/reconcile 与明确 local/remote availability。

## 验收

- remote work 不回落本机 path/runtime/credential。
- 远端 crash、SSH carrier loss、一个 session corruption 的故障半径彼此隔离。

Blocked by #3777 and #3778. Blocks #3780.

Canonical plan: `docs/issues/dsh-native-integration/`.

Start with docs/issues/dsh-native-integration/ and review blockers #3777 and #3778 before identifying the relevant runtime, SSH, and scope entry points. Done means remote scopes keep runtime, paths, credentials, and recovery remote-owned, support reconnect/reconcile, and isolate remote crashes, SSH loss, and session corruption without falling back locally.

Written by the indexing model from the issue text.