Wishes that outlive the session

Key features

• No pnpm, no network, no build authorization.
• A granted wish is ordinary code that runs at every boot, with the harness's full context.
• A kept dynamic package changes realms.
• A granted wish is written straight into $DSH_HOME/genie/ and linked where the launcher already resolves modules.
• Compare that to the normal path for a git-installed plugin, which needs a prepare script from the author and an allowBuilds grant from you — arbitrary code execution at install time, outside every sandbox the agent runs in.