test: verify packed plugin installation and pinned-host loading

.github/workflows/ci.yml

@@ -132,6 +132,12 @@ jobs:
           version="$(node -p "require('./package.json').version")"
           pnpm verify:tarball -- "artifacts/dsh-github-copilot-$version.tgz"
 
+      - name: Install verified archive and load it through the pinned Core host
+        shell: bash
+        run: |
+          version="$(node -p "require('./package.json').version")"
+          pnpm exec node scripts/verify-install-smoke.mjs --archive "artifacts/dsh-github-copilot-$version.tgz" --host-modules node_modules
+
   published-adapter:
     name: Published adapter (${{ matrix.os }})
     strategy:

README.md

@@ -157,6 +157,15 @@ node package/scripts/check-search-composition.mjs --profile-dir /absolute/profil
 
 Supply any launcher patches with repeated `--patch /absolute/file`. Require `supported: true`: the install command does not automatically run this preflight. Unsupported/custom Web composition and `NONEMPTY_DISPOSABLE_PROFILE_ROOT` are stop conditions. Preserve a nonempty root and review whether public composition reconstructs it before any separately approved normalization; never assume it can be cleared. Check effective shared-peer resolution so stale profile-local packages do not shadow Desktop's official peers.
 
+Install the exact, checksum-verified release archive shown below; do not use a
+checkout directory as a release package. `pnpm add <directory>` creates a
+`link:` development dependency and does not install that directory's production
+dependencies. For development, install the checkout's dependencies before
+linking it and keep the checkout available at the linked path. A package manager
+showing **Installed** confirms its profile record, not that runtime dependencies
+resolved or that the plugin loaded; verify the exact DSH/profile startup result
+separately.
+
 For a **standalone named profile**:
 
 ```sh

README.zh.md

@@ -132,6 +132,12 @@ node package/scripts/check-search-composition.mjs --profile-dir /absolute/profil
 
 启动 patch 用重复的 `--patch /absolute/file` 提供。必须得到 `supported: true`；安装器不会自动执行此预检。不支持的／自定义 Web 组合及 `NONEMPTY_DISPOSABLE_PROFILE_ROOT` 均须停止。先保全非空 root，并核对公开组合能否完整重建，再另行批准规范化；不能默认清空。检查实际共享 peer 解析，避免旧 profile-local 包遮蔽官方 Desktop peer。
 
+请安装下方的精确版本、checksum 已核验的发布归档；不要把 checkout
+目录当作发布包。`pnpm add <directory>` 会创建 `link:` 开发依赖，不会替该
+目录安装生产依赖。开发时应先安装 checkout 的依赖再建立链接，并确保链接目标持续可用。
+包管理器显示 **Installed** 只表示 profile 记录已接受，不代表运行依赖已解析或插件已成功加载；
+还应单独核对目标 DSH/profile 的启动结果。
+
 **独立具名 profile**：
 
 ```sh