fix(custom-model): guard, document and test the session-supplied dsh home

Second review round on PR #755: skip non-absolute DSH_HOME candidates so a relative home can never mkdir under the server cwd; probe a session-supplied home with probePathKind in both async routes before the synchronous apply; test the session env-override lookup (seventh arg) incl. the self-link fall-through and the relative-home skip; reject '.' and '..' as realHomeFallback and enforce linkFromRealHomeDirs subset in the schema; fix the stale apply JSDoc and the two doc lines lagging the verified dsh run; state the shared/isolated split plainly.

src/config/cli-registry/schema.ts

@@ -599,14 +599,14 @@ const capabilitiesSchema = z
           // linking; missing files are skipped). Same segment pattern, see types.ts.
           linkFromRealHomeDirs: z.array(homeSegmentName).max(8).optional(),
           // The real home's fallback location, relative to the user's home: ONE segment —
-          // a leading dot is legitimate (`.dsh` is what ships) but separators and `..`
-          // are not; the consumer joins it under the user's home, and a traversal here
-          // escapes that home.
+          // a leading dot is legitimate (`.dsh` is what ships) but separators, `..` and
+          // bare `.` are not; the consumer joins it under the user's home, a traversal
+          // here escapes that home and `.` IS that home (linking THROUGH it unshielded).
           realHomeFallback: z
             .string()
             .min(1)
             .max(80)
-            .regex(/^(?!\.\.\/?$)[^/\\]+$/)
+            .regex(/^(?!\.\.?$)[^/\\]+$/)
             .optional(),
         })
         .strict()
@@ -629,6 +629,19 @@ const capabilitiesSchema = z
               });
             }
           }
+          // types.ts documents the dirs list as "must be a subset of linkFromRealHome";
+          // a name absent from it names nothing (missing-file entries are skipped as
+          // files), so the recipe would silently stop creating a directory it declares.
+          const linkedNames = new Set(recipe.linkFromRealHome ?? []);
+          for (const dir of recipe.linkFromRealHomeDirs ?? []) {
+            if (!linkedNames.has(dir)) {
+              ctx.addIssue({
+                code: 'custom',
+                message: `linkFromRealHomeDirs must be a subset of linkFromRealHome: ${JSON.stringify(dir)} is not linked, so the directory rule for it can never apply`,
+                path: ['linkFromRealHomeDirs'],
+              });
+            }
+          }
         }),
       z.object({ kind: z.literal('unsupported') }).strict(),
     ]),