DSH: define explicit Orca interoperability without identity collapse

## 目标

仅在明确 Cindy-owned provenance、权限、预算、并发、结果和恢复契约下与 Orca 互操作。

## 交付

- 将 `cindy-dsh` task/activity 与 Orca worker 在 DB、UI、stop、audit、remote 与 Mobile 全链路区分。
- 对已证明的 DSH-as-Orca Lead/Worker 情形实现显式 policy；其他嵌套拒绝并解释。

## 验收

- 不把 Cindy DSH activity 当 Orca worker，也不把 Orca 记录伪装 DSH。
- 现有 Orca、Claude、Codex、Pi workflows 回归。

Blocked by #3780. Blocks #3782.

Canonical plan: `docs/issues/dsh-native-integration/`.

Start by reading docs/issues/dsh-native-integration/ and the prerequisite issue #3780. Map the stated DSH and Orca distinctions across DB, UI, stop, audit, remote, and Mobile before defining the explicit policy cases. Done means the listed identity boundaries hold, unsupported nesting is rejected with an explanation, and existing Orca, Claude, Codex, and Pi workflows regress successfully.

Written by the indexing model from the issue text.