Merge remote-tracking branch 'origin/master' into worktree-plugin-config-guideline

Master's docs-overhaul stack (#142-#144) rewrote AGENTS.md into the
slim budget-gated form and repointed the review skill's citations.
Resolutions:
- AGENTS.md: master's rewrite wins; the no-hardcoded-tunables
  convention is re-added as one terse bullet in the new style, after
  'Explicit > implicit at package seams'. Within the verify-doc-budgets
  ceiling, so no displacement or raise needed.
- dsh-code-review SKILL.md: master's repointed citations win; the
  hardcoded-tunables reviewer check and the Conventions keyword are
  re-applied on top.
- packages/README.md: master replaced the hand-maintained dependency
  list (which carried this branch's chars-per-token wording) with a
  pointer to the generated module graph — master's side taken whole;
  the estimator wording lives on in the compact package READMEs.

packages/web/web-search-deepseek/tests/deepseek.e2e.ts

@@ -10,7 +10,7 @@ import {
 
 /**
  * Real-API smoke for the DeepSeek search provider. Self-skips without
- * `$DEEPSEEK_API_KEY`, per the with-key e2e policy in AGENTS.md § Secrets. This
+ * `$DEEPSEEK_API_KEY`, per the with-key e2e policy in docs/testing.md. This
  * is the only test that proves DeepSeek's Anthropic-compatible endpoint actually
  * triggers native `web_search` and returns the structured result blocks the
  * provider parses — a mock cannot confirm the wire shape is real.

packages/web/web-search-exa/tests/exa.e2e.ts

@@ -3,7 +3,7 @@ import { ExaSearchProvider, EXA_DEFAULT_BASE_URL, EXA_DEFAULT_HIGHLIGHTS_PER_RES
 
 /**
  * Real-API smoke for the Exa search provider. Self-skips without `$EXA_API_KEY`
- * (CI has no secrets), per the with-key e2e policy in AGENTS.md § Secrets.
+ * (CI has no secrets), per the with-key e2e policy in docs/testing.md.
  */
 const apiKey = process.env.EXA_API_KEY
 const maybe = apiKey !== undefined && apiKey.length > 0 ? describe : describe.skip

packages/web/web-search-perplexity/tests/perplexity.e2e.ts

@@ -3,7 +3,7 @@ import { PerplexitySearchProvider, PERPLEXITY_DEFAULT_BASE_URL, PERPLEXITY_DEFAU
 
 /**
  * Real-API smoke for the Perplexity search provider. Self-skips without
- * `$PERPLEXITY_API_KEY`, per the with-key e2e policy in AGENTS.md § Secrets.
+ * `$PERPLEXITY_API_KEY`, per the with-key e2e policy in docs/testing.md.
  */
 const apiKey = process.env.PERPLEXITY_API_KEY
 const maybe = apiKey !== undefined && apiKey.length > 0 ? describe : describe.skip