Implement the session cost plugin

Host half wraps globalThis.fetch to read usage.cost out of provider
responses (tee, never clone) and listens on the llm/stream seam for the
session; the two halves join on the generation id. Client half adds one
pill to the composer dock under its own id, so the harness's native stats
stay where they are.

Verified against the live API: three calls in one session (agent reply,
compaction, session title) attributed with per-purpose totals, an unknown
session answered with null, the ledger written and reloaded across
instances, and the pill rendering only when a cost exists.

cordis.patch.yml

@@ -0,0 +1,6 @@
+# dsh-session-cost bundle patch: mounts the plugin into a profile layer stack.
+# The row id is the key users override in their profile's cordis.patch.yml; the row
+# name is the module this package exports, so it must stay the package name.
+- insert:
+    - id: session-cost
+      name: 'dsh-session-cost'