feat: support DSH 0.1.2 alpha

[rcyw]

Summary

• adapt cold-session preset restoration to the DSH 0.1.2-alpha.1 projection contract
• raise audited peer floors while retaining the installable rc.2 dependency baseline
• add fixed-SHA CI actions, exact Git-install smoke coverage, and release identity gates
• release as dsh-webhook v0.5.1

Compatibility evidence

• DSH source: cd5ef8148158c3a752a658978873241fdf8e2bbc (dsh-v0.1.2-alpha.1)
• registry baseline: 0.1.1-rc.2 (alpha packages are not yet published to npm)
• 83 tests, typecheck, build, prepare, self-contained and peer checks pass against both dependency faces
• standalone dsh-webhook remains additive to the new core webhook runtime: it owns persistent receipts, deduplication, replay, generic auth and callbacks