dsh-safemode-profile

Safemode profile enforcer: force-restores ~/.dsh/profiles/safemode to a clean whitelist (dsh-base + dsh-web-app) on start and continuously guards it against modification, so dsh --profile safemode always boots with zero third-party plugins. No build scripts: the bundle row does all work.