Host baseline layer: shipped manifest + lock converged by dev up

[JPDuchesne]

Summary

Implements the host baseline layer of d3mlabs/plans#26 (closes #102): every d3mlabs host converges toward one org-invariant tool set, owned by dev's release.

• Dev::Deps::Baseline — the layer's policy object. The manifest (share/baseline/dependencies.rb: git, gh, rbenv, shadowenv, darwin-gated cursor-agent) and its committed lock ship inside dev's distribution; hosts install the pin, never resolve (bin/update-baseline.rb regenerates the lock in this repo). Convergence state is one host-side stamp under $XDG_DATA_HOME/dev/host-baseline/ with the same O(1) digest check projects get (Staleness gains a fixed state_key: override).
• dev up converges the baseline as its first step (no-op on warm hosts), and becomes valid outside any dev.yml — host layer only, which is the fresh-box bootstrap (brew install dev → dev up → ready).
• Warn-only nag everywhere else: DependencyService#guard! surfaces "host baseline stale — run dev up" as advisory, even in CI — the baseline never blocks a project command.
• New cursor_agent integration (registry + DSL verb): Cursor publishes no release feed, so resolution pins the version the served install script bakes into its download URL; install lands the pinned package in a version-keyed dir with a current symlink (publish_current lifted from GhIntegration into the Integration base). AI_FLOW_AGENT_BIN points at <install_dir>/current/cursor-agent.

Incidentally smoke-tested end to end: a spawned dev up outside a project converged this workstation for real — brew formulae verified, cursor-agent 2026.08.11-e8db854 installed with marker + current pointer, stamp written, second run O(1)-quiet.

Test plan

• dev test — 959 tests, 0 failures (new: baseline staleness/converge/lock lifecycle, cursor_agent repository + integration incl. real curl/tar boundaries via PATH shims, concurrent publish, guard/up wiring)
• dev style, dev tc clean
• All new/changed lines covered (patch gate is 100%)
• Manual: dev up outside a project converges then goes quiet; baseline nag appears on other commands when stale

Made with Cursor

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!