chore(deps): re-pin DSH runtime to 0.2.0-rc.2

[chintoleung]

Re-pins workspace deps and bridge peers/devDeps from 0.2.0-rc.1 to 0.2.0-rc.2 and refreshes pnpm-lock.yaml. #105 has since merged, so this is a clean 13-file re-pin on top of main. Refs #104.

Why version-only (no code changes)

• The pin bump is load-bearing by itself. Bridge peers are exact pins, and the host peer gate runs semver.satisfies('0.2.0-rc.2', '0.2.0-rc.1') → false, so the whole bundle gets skipped — the [兼容] DSH 0.2.0-rc.2 下 bundle 被 peer 校验整体跳过，browser_* 工具不可用 #104 failure mode, one version up. Without this re-pin, dsh-browser does not load on any 0.2.0-rc.2 host.
• rc.1 → rc.2 changed nothing the bridge touches. The release notes cover desktop-app fixes only (menu-bar dsh command, terminal menu dedup, plan-review fixes, PowerShell completion, Intel Mac signing, login-shell env, model-picker search, etc.).
• Confirmed empirically, not assumed: the bridge-facing API surface is identical in both runtimes (ContextFormed, createUserMessage, five-arg wireStream.open), and the full battery below passes on the pinned 0.2.0-rc.2 runtime with zero source changes.

For reference, the rc.1 verification of #105 — including its manual live-host checklist item — is documented in the review thread: verification review on #105.

Verification on rc.2 (macOS arm64, Node 24.21.0, pnpm 11.7.0)

• pnpm run check:runtime
• typecheck (bridge + extension)
• bridge tests 142/142, extension tests 388/388
• pnpm run test:smoke — peer gate accepts the bundle, hello.ok without stream-failed, V2 migration and browser-context V4 snapshots persist, projections survive restart