release 1.55.0: build approvals on every host, and badges that stop lying

- "Allow build scripts and retry" now writes a key pnpm accepts for a
  GitLab, Bitbucket or self-hosted install (#665, by @po-et). It wrote the
  bare package name, which is the one form pnpm does NOT match (#68/#69),
  so the button looked like it worked, the YAML gained a line, and the
  retry failed identically. Only reachable since #637 stopped these
  installs from being replaced by a same-named npm package first.
- The Favorites tab loads host requirements for its cards (#669, by
  @liuwenji007). It reuses the Discover card, whose badge read "Reading
  host requirement…" forever there, because only Discover ever triggered
  the fetch. And the badge is quiet unless it has something to say (#666):
  a card that meets its requirement, or cannot be checked, no longer
  carries a mark.
- The host package manager's env is documented as REPLACING the process
  env rather than filling its gaps (#653, by @Yur0918) — deliberately the
  opposite of the GIT_*/PNPM_CONFIG_* rule, because PATH is a capability
  (where node is), not a preference.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "dshmarket",
-  "version": "1.54.0",
+  "version": "1.55.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "dshmarket",
-      "version": "1.54.0",
+      "version": "1.55.0",
       "license": "MIT",
       "dependencies": {
         "js-yaml": "^4.1.0",

package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.54.0",
+  "version": "1.55.0",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",