fix(ci): restore published DSH compatibility lane

[Altairpaca]

Problem

The scheduled dsh-release-compat lane has failed on main since the published DSH 0.1.0-rc.7 dependency graph began resolving koffi@3.2.1 instead of the previously reviewed 3.2.0.

The failure is intentional fail-closed behavior from pnpm 11's allowBuilds gate, not a DSHelm build regression:

• workspace install/build/package checks pass;
• packed DSHelm artifacts install successfully;
• external DSH install stops at ERR_PNPM_IGNORED_BUILDS: koffi@3.2.1.

Change

• update the isolated published-DSH build approval from koffi@3.2.0 to koffi@3.2.1;
• keep exact version matching so future transitive native-build drift still fails closed.

Evidence boundary

This does not widen the verified DSH baseline or promote any newer Harness release. It only restores the existing 0.1.0-rc.7 compatibility journey after reviewing the new Koffi patch release.