fix(runtime): synchronize lockfile after builtin plugin migration

image/entrypoint.sh

@@ -11,7 +11,15 @@ if [[ -f "${DSH_HOME}/profiles/web/package.json" ]]; then
     if node -e 'import("/usr/local/lib/dsh-mgr/reconcile-profile.mjs").then(({BUILTIN_DEPENDENCIES:pins,BUILTIN_OVERRIDES:overrides})=>{const m=require(process.env.DSH_HOME+"/profiles/web/package.json"); process.exit([m.dependencies,m.devDependencies,m.optionalDependencies].every(section=>Object.entries(section||{}).every(([n,v])=>pins[n]===v))&&Object.entries(m.pnpm?.overrides||{}).every(([n,v])=>overrides[n]===v)?0:1)})'; then
         install_env=(npm_config_offline=true)
     fi
-    if timeout --signal=TERM --kill-after=5s 120s env CI=true "${install_env[@]}" dsh plugin --profile web install --ignore-scripts; then
+    # Only migration installs may refresh the lockfile. Keep the marker on failure
+    # so a restart retries even when package.json already contains the new pins.
+    pending_lockfile="${DSH_HOME}/profiles/web/.dsh-lockfile-pending"
+    install_args=()
+    if [[ -f "$pending_lockfile" ]]; then
+        install_args+=(--no-frozen-lockfile)
+    fi
+    if timeout --signal=TERM --kill-after=5s 120s env CI=true "${install_env[@]}" dsh plugin --profile web install --ignore-scripts "${install_args[@]}"; then
+        rm -f -- "$pending_lockfile"
         echo "dsh-mgr: plugin prestart reconciliation complete" >&2
     else
         status=$?