feat(plugins): ship optional bundles switched off and guide the install dialog

The dsh installation lists under `dsh.optionalBundles` the bundles it
ships for a person to switch on. The plugin manager reports them as
`optional`, and the Web plugin page shows them first, in a built-in
group with an official tag, off until selected and never removable.
Agent Teams ships this way, so a blank profile offers both of its
layers. Default-product isolation, the workspace constraints, and the
packed-install check accept that one dependency edge and nothing else
experimental.

A bundle's title and one-liner come from `dsh.title` and the new
`dsh.description`, else from the package name and `description`. A
dependency without a bundle patch is no longer listed unless the
profile selects it. The install dialog asks for a package name or
address; a guide under the field shows the three accepted forms with
an example each and ends in a security warning, and the copy no longer
speaks of a plugin ID.

docs/user/develop/basic/publish.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/user/develop/basic/publish.md
-publish.md: 17b0cb80f9cf385773ae9e1f4d7061ec1df9c1a2
-publish.zh.md: 3cc65af58d34028a6bff03455451153e2c7f439b
+publish.md: da3a80a809a2e01b5f5914178a8d34e8c4453fc1
+publish.zh.md: 3baa952d42c3a223b8ce1aeea326799e10cbe1f5

docs/user/develop/basic/publish.md

@@ -39,10 +39,16 @@ Create `hello-plugin/package.json`:
   "type": "module",
   "main": "index.js",
   "files": ["index.js", "cordis.patch.yml"],
-  "dsh": { "bundle": { "patch": "./cordis.patch.yml" } }
+  "dsh": {
+    "title": "Hello plugin",
+    "description": "Logs a greeting when it loads.",
+    "bundle": { "patch": "./cordis.patch.yml" }
+  }
 }
 ```
 
+`dsh.title` and `dsh.description` are what users see where bundles are listed, such as the Web sidebar's Plugins page; without them the page shows the package name stripped of its scope and `dsh-` prefix, and the package `description`.
+
 Create `hello-plugin/index.js` with the plugin entry point:
 
 ```js

docs/user/develop/basic/publish.zh.md

@@ -39,10 +39,16 @@ hello-plugin/
   "type": "module",
   "main": "index.js",
   "files": ["index.js", "cordis.patch.yml"],
-  "dsh": { "bundle": { "patch": "./cordis.patch.yml" } }
+  "dsh": {
+    "title": "Hello plugin",
+    "description": "Logs a greeting when it loads.",
+    "bundle": { "patch": "./cordis.patch.yml" }
+  }
 }
 ```
 
+`dsh.title` 与 `dsh.description` 是用户在组合包列表（例如 Web 侧栏的插件页）里看到的名字和简介；没有它们时，页面显示去掉 scope 和 `dsh-` 前缀的包名，以及包的 `description`。
+
 创建 `hello-plugin/index.js`，写入插件入口：
 
 ```js