fix: pin the DSH dependency line to 0.1.0-rc.8 so global installs resolve - #100

Fixes #96

Problem

npm install --global rsi-gear fails with ERESOLVE on both npm 10 (reported) and npm 11 (reproduced):

While resolving: @deepseek-ai/[email protected]
Found: @deepseek-ai/[email protected]

The published manifest mixes DSH lines: seven dependencies declare ^0.1.0-rc.8 || ^0.1.1-rc.2 (which resolves to 0.1.1-rc.2), while @deepseek-ai/dsh-token-meter is exactly pinned at 0.1.0-rc.8 and its non-optional peer chain (dsh-compaction -> dsh-commands -> dsh-agent, all ^0.1.0-rc.8) needs the 0.1.0-rc.8 line. Semver prerelease rules make the two lines mutually exclusive, so a single global install cannot place one dsh-agent.

Both existing package gates (check-project-package, check-public-api-package) install the tarball locally, where npm only warns: the exact published 0.2.1 tarball passes a local install with 42 ERESOLVE override warnings and hard-fails a global install.

Change

• Pin the seven wide DSH dependency ranges to 0.1.0-rc.8, matching the dsh-token-meter pin, the repo lockfile, the devDependencies and the paper line. peerDependencies stay wide, so the documented host compatibility (0.1.0-rc.8 or 0.1.1-rc.2) is unchanged and no docs need updating.
• Add scripts/check-global-install.mjs plus a quality-job CI step that packs the tarball and installs it --global into a temp prefix, closing the local/global blind spot (as suggested in the issue).

The widening alternative (relaxing dsh-token-meter to ^0.1.0-rc.8 || ^0.1.1-rc.2) also resolves the conflict, but it abandons the intentional paper pin and would ship a DSH line that the repo's own lockfile and CI never test, so this PR pins instead.

Compatibility

• No source changes; peerDependencies and their documented ranges are untouched.
• The lockfile is updated in lockstep (the same seven spec lines) — npm install --package-lock-only moves no resolved version across all 291 packages, and npm ci --dry-run confirms the lockfile is in sync on both npm 11 and npm 10 (CI's line).
• The fix reaches npm users on the next release bump (publish-npm.yml skips already-published versions).

Validation

Run on Windows 11 (Node 24.12.0, npm 11) against dev:

• npm pack --ignore-scripts + npm install --global --prefix <tmp> --ignore-scripts <tarball>: fails before the dependency pin with the ERESOLVE above; passes after (55 packages, DSH graph resolves uniformly to 0.1.0-rc.8).
• The exact README command shape npm install --global <tarball> agent-hitch@latest @deepseek-ai/dsh@latest resolves cleanly (672 packages, 0 ERESOLVE warnings).
• node scripts/check-global-install.mjs: fails pre-fix, passes post-fix — this is what CI now runs.
• npm run typecheck: pass. ./node_modules/.bin/eslint "src/{domain,ports,runtime,application,adapters,cli}/**/*.ts" (direct invocation; the npm run lint script's single-quoted glob is Windows-broken, unchanged here): 0 findings.
• npm install --package-lock-only --ignore-scripts diff verified: spec strings only, no resolved-version movement.

Run with Windows-only pre-existing failures (identical on a clean dev checkout, unrelated to this change, both green on ubuntu CI): check:boundaries (path-separator artifact in the checker itself) and check:contracts (CRLF artifact). Not run locally (Windows environment): the full vitest suite (its globalSetup spawns npm without a shell — Windows-incompatible, pre-existing and out of scope here) and the ubuntu/macOS matrix. CI runs the full regression suite on this PR.

Credit: @yuesu0202's report and diagnosis (including the tested widening variant) made this fix quick to land.