fix: support DeepSeek Harness 0.1.1-rc.2

[labmimors]

What changed

• align MCP Lens peers, development graph and shrinkwrap with exact DeepSeek Harness 0.1.1-rc.2 components
• add packed-component and fresh-profile verification, including mixed-version rejection, receipts and Windows coverage
• prepare MCP Lens 0.1.0-rc.10 install guidance without changing runtime behavior or retrieval ranking
• group future DeepSeek Harness Dependabot updates so prerelease components move together

Why

The official Harness release is now 0.1.1-rc.2 while this repository still pinned the rc.6 component graph. Updating components independently can create a mixed prerelease graph; this change fails closed on that state.

Local verification

• Node 24.18.0: typecheck, build, 7 test files / 100 tests, benchmark reproduction, production audit
• Node 22.19.0: typecheck, build, 7 test files / 100 tests, benchmark reproduction, production audit
• packed install: DSH_INSTALL_OK with 15 component packages at 0.1.1-rc.2
• fresh official profile: dsh 0.1.1-rc.2 loaded the Lens bundle; 188 detected DSH packages were all 0.1.1-rc.2
• staged secret and forbidden-file scans: no matches

This PR prepares v0.1.0-rc.10 for the npm next tag. The release is not complete until CI passes and the npm registry tarball is read back byte-for-byte against the reviewed GitHub asset. The latest npm tag will not be moved by this release.

Supersedes the partial prerelease bumps in #33, #35, #36 and #37.