fix(generations): isolate profile projection from pnpm

[yaojin3616]

Summary

• stage generation installs, updates, and removals for the next cold start instead of replacing live Profile links
• keep dsh-market version inventory visible while deferring both bundles and node_modules projection until Harness is stopped
• temporarily remove generation-owned dependency and override fields around every Profile pnpm run, then restore them without disturbing pnpm-managed fields
• fail closed when a projected Profile cannot use the generation-aware pnpm runner

Why

Generation projection and pnpm previously both owned profiles/web/node_modules/<plugin>. On Windows, pnpm could therefore attempt <plugin>_tmp_* -> <plugin> while the existing generation junction or live Harness still held the destination, producing EPERM and a failed install. This change gives the path a single owner: the cold-start generation projector.

Validation

• npm test (76 files, 613 tests)
• npm run typecheck
• npm run build
• real offline pnpm regression verifies the projected plugin is absent from pnpm-lock.yaml and its generation link remains unchanged