feat(context): add dsh executor and headroom active loopback probe

Wire DeepSeek Harness as an optional fourth code executor (default off)
and add a loopback observation script that compares prompt tokens through
headroom proxy with OPENAI_TARGET_API_URL pointed at the compat proxy.

Co-authored-by: Cursor <cursoragent@cursor.com>

dsh-agent-launch.test.mjs

@@ -0,0 +1,44 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  buildDshExecutorLaunchPlan,
+  dshExecutorEnabled,
+  resolveDshCommand,
+} from './dsh-agent-launch.mjs';
+
+test('dshExecutorEnabled defaults to false', () => {
+  assert.equal(dshExecutorEnabled({}), false);
+  assert.equal(dshExecutorEnabled({ MEMIND_TOOL_GATEWAY_DSH_ENABLED: '1' }), true);
+});
+
+test('resolveDshCommand falls back to npx package when forced', () => {
+  const resolved = resolveDshCommand({
+    MEMIND_DSH_FORCE_NPX: '1',
+    MEMIND_DSH_NPX_BIN: 'npx',
+  });
+  assert.equal(resolved.viaNpx, true);
+  assert.equal(resolved.command, 'npx');
+});
+
+test('buildDshExecutorLaunchPlan requires enable flag', () => {
+  const plan = buildDshExecutorLaunchPlan({
+    cwd: '/tmp/work',
+    instruction: 'fix tests',
+    env: {},
+  });
+  assert.equal(plan.ok, false);
+});
+
+test('buildDshExecutorLaunchPlan builds headless args when enabled', () => {
+  const plan = buildDshExecutorLaunchPlan({
+    cwd: '/tmp/work',
+    instruction: 'fix tests',
+    env: { MEMIND_TOOL_GATEWAY_DSH_ENABLED: '1', MEMIND_DSH_NPX_BIN: 'npx' },
+    runtimeEnv: { DEEPSEEK_API_KEY: 'test-key' },
+  });
+  assert.equal(plan.ok, true);
+  assert.equal(plan.executor, 'dsh');
+  assert.ok(plan.args.includes('headless'));
+  assert.ok(plan.args.at(-1).includes('fix tests'));
+  assert.equal(plan.env.DEEPSEEK_API_KEY, 'test-key');
+});