[yaojin3616]

Summary

Closes #744. When a generation cannot resolve a missing @deepseek-ai/* dependency, validate it using the explicitly supplied current Harness installation anchor. Keep ordinary third-party packages plugin-owned; do not override existing private packages or exports errors.

Loading Contract

This changes installation-time generation peer validation, not runtime import order. It reads manifests from the generation and resolves only missing Harness packages from dshEntryPath. No generic installation-directory fallback, cwd changes, NODE_PATH, shared-tree mutation or Safe Mode change. Existing closure/private-singleton failures remain actionable.

Validation

• Added a regression with the Profile and installation in disjoint directories and no profiles/node_modules: failed before the fix and passed after it.
• 52 tests passed across generation-installer, plugin-manager-generation-backend, generation-runtime-resolution and generation-projection, including real Harness resolution/profile-loader child processes.
• npm run typecheck, npm run build and git diff --check passed.
• Full npm test attempted: 211 files / 2179 tests passed, 8 files / 27 tests failed. Failures include nested sandbox-exec denial, Electron runtime expectations, native ASAR/PTY tests and startup assertions. Full regression is not green in this environment.

Not Verified

Windows junctions/native process behavior, signed packaged application, authenticated browser bootstrap/UI activation and actual market update through the installed app. This does not resolve #723: allowing arbitrary host third-party peers would violate the repository's explicit host fallback boundary.