dsh: add hook-based auto-update once dsh config surface stabilizes

[jeff-r2026]

Background

PR #319 added DeepSeek Harness (dsh) as a supported agent, but deliberately wired only skills sync (~/.dsh/skills, scanned natively by dsh's skill-filesystem provider). It did not inject any teamai hook for dsh.

Consequence: dsh's ~/.dsh/skills is only kept fresh when some other hook-enabled host (Claude Code / Codex / …) triggers teamai pull — dsh rides along. A user running dsh alone gets no automatic updates and must run teamai pull manually.

This was an intentional deferral, per the PR:

hooks/env/MCP can follow once the dsh-side config surface stabilizes.

Why hooks were deferred (evidence from the dsh source)

• dsh ships only at 0.1.1-rc.1 — a release candidate, config surface not yet frozen.
• Its hook layer (@deepseek-ai/dsh-hooks-claude-code / -codex) is explicitly a compatibility bridge, not a first-class surface: "The bridge exists only as a compatibility path... anything bespoke should be a native plugin."
• Blocker for teamai's model: hook config is process-level, parsed once at load, resolved against the process launch cwd — there is no per-session config discovery yet (TODO(per-session-hook-config) in the bridge). teamai's auto-update relies on a per-session SessionStart trigger, which dsh cannot currently express.

What this issue tracks

Once dsh's hook config surface stabilizes (specifically per-session hook-config discovery lands, and the harness reaches a non-rc release), revisit adding dsh to teamai's hook injection so that:

• dsh gets a SessionStart-equivalent hook that triggers teamai pull on its own — standalone dsh users get automatic updates without relying on a co-installed Claude/Codex.
• Evaluate env / MCP sync for dsh at the same time (also deferred in feat(dsh): add DeepSeek Harness as a supported agent #319).
• Add dsh to the hook-injection path in src/hooks.ts (injectHooksToAllTools / reconcileHooksToAllTools) — dsh currently has no settings field in toolPaths, so both paths continue past it today.

Watch signals

• dsh removes TODO(per-session-hook-config) / ships per-session hook config discovery.
• dsh cuts a stable (non-rc) release.

Related: #319