Accept dsh 0.2 prereleases in the peer ranges

[forrestlinfeng]

>=0.1.5-0 (from #28) looks open-ended, but npm and pnpm check peers without includePrerelease, and then a prerelease only satisfies a comparator on its own major.minor.patch. So the range refuses every dsh 0.2 prerelease the plugin already runs on:

dsh	where it ships	>=0.1.5-0
0.2.0-rc.2	DSH Desktop 2.0.17	refused
0.2.1-rc.2	npm next	refused
0.2.1-alpha.5	npm alpha	refused

CI's dsh-compatibility (next) and (alpha) jobs already pass against those lines; only the declared range is wrong. It also makes dshfind's Desktop install check fail on runtime-range:* once its Desktop version constant catches up.

• dsh peers become >=0.1.5-0 || >=0.2.0-0 || >=0.2.1-0: one branch per line, still no upper bound. A later prerelease line (0.2.2-*, 0.3.0-*) needs its own branch.
• The cordis peer adds ^4.0.5-0 for the 4.0.5-alpha.* the dsh alpha line pins.
• test/peer-ranges.test.js checks the ranges with strict semver against each line. On the old ranges two of its three tests fail.

npm users get this from the next release; this PR does not bump the version.

🤖 Generated with Claude Code

---

Note

Low Risk
Metadata-only peer range and test changes; no runtime plugin logic is modified.

Overview
Fixes declared peer dependency ranges so npm/pnpm no longer reject DSH 0.2.x prereleases the plugin already supports. Under default semver (no includePrerelease), >=0.1.5-0 does not match 0.2.0-rc.2 and similar lines.

DSH peers (dsh-llm, dsh-skill, dsh-tools) are now >=0.1.5-0 || >=0.2.0-0 || >=0.2.1-0—one lower-bound branch per supported release line, still without an upper cap. Cordis adds ^4.0.5-0 alongside the existing ^4.0.1-rc.1 for alpha-track cordis pins.

Adds semver as a dev dependency and test/peer-ranges.test.js to assert accepted/rejected versions against package.json peers (including older-than-0.1.5 rejections).

^{Reviewed by Cursor Bugbot for commit 37f66e7. Bugbot is set up for automated code reviews on this repo. Configure here.}