ci(test)(docs): re-align the verified runtime baseline to @deepseek-ai/dsh@0.1.7-rc.1

[btspoony]

Summary

Re-aligns the crate's verified-runtime baseline from @deepseek-ai/dsh@0.1.3-alpha.2 (contract ref c389f96bf3, 2026-09-08) to @deepseek-ai/dsh@0.1.7-rc.1 (upstream 46a7f68b, 2026-09-23), based on a full compatibility study of the upstream range v0.1.5-rc.2 → v0.1.7-rc.1 (3304 commits). The SDK JSON-RPC protocol core is byte-identical across that range and the Python SDK source is unchanged, so no crate code change is required — this PR re-verifies that claim, moves the CI baseline, and locks the resilience in.

• Spec re-verification (all green): every wire/launch re-verification grep re-run at tag dsh-v0.1.7-rc.1 (32 inventory rows + 3 spot-checks). Two upstream drift clusters were found and amendment-recorded in the wire spec with a normative crate divergence: LLM-level ContentBlockMap (7 members; tool-result removed; new tool-addition/tool-removal) and SESSION_FORMAT_VERSION 3→4 (session format V4).
• CI pin: keyless-runtime-handshake now installs @deepseek-ai/dsh@0.1.7-rc.1 (exact pin, never a dist-tag); pin rationale rewritten; verified locally against the real 0.1.7-rc.1 runtime (handshake 2 passed, dsh --version 0.1.7-rc.1).
• V4 passthrough locked in tests: two new fake-runtime scenarios prove the flattened role:'tool' tool/result message and the developer/message event pass through Session::run verbatim (events land in RunResult.events, callback observes them, final_response/finish_reason anchoring unaffected).
• Docs: README pair fact-walked (11/11 claims true at the new baseline; zero-diff on first pass), the "Session format v2" section made version-neutral (bilingual parity, hashes re-recorded), Route C basis wording clarified, knowledge-doc pin example de-literalized.
• Changelog fragment: .changes/unreleased/dsh-0.1.7-rc1-realignment.md (Changed).

No public API change; no Cargo.toml change.

Test plan

• cargo test — 187 passed / 0 failed (incl. the 2 new V4 passthrough tests and the keyless real-runtime handshake tier against 0.1.7-rc.1)
• cargo fmt --check / cargo clippy --all-targets -- -D warnings
• CI keyless-runtime-handshake job will verify the new pin end-to-end

[cursor]

PR Summary

Low Risk
Changes are limited to CI pin, specs/docs, and fake-runtime tests with no library code edits; the main operational risk is CI failing if the pinned npm runtime is unavailable or incompatible.

Overview
Re-aligns the crate’s verified runtime baseline from @deepseek-ai/dsh@0.1.3-alpha.2 to @deepseek-ai/dsh@0.1.7-rc.1 after re-running wire/launch contract checks at upstream tag dsh-v0.1.7-rc.1. No src/ or public API changes—this PR moves CI, documents drift, and adds regression tests.

The keyless-runtime-handshake job now installs and caches the new exact npm pin (comments and error strings updated). The wire spec gains drift amendments: upstream ContentBlockMap grew (tool-addition/tool-removal, tool results as message roles) with an explicit normative decision to keep the crate’s six typed blocks + Unknown; SESSION_FORMAT_VERSION is now 4 at the pin, with the crate still treating session.event as opaque.

Two fake-runtime tests lock verbatim passthrough for V4 tool/result (flat role: "tool") and developer/message through RunResult.events, callbacks, and unchanged final_response/finish_reason derivation. README pair and knowledge docs clarify spec citation ref vs CI test pin and broaden the session-format section beyond v2-only wording.

^{Reviewed by Cursor Bugbot for commit 35a715f. Configure here.}