fix: address human review — default providerName dsh-sdk; raise composition-e2e deadline

- subagent-sdk: the default registry name becomes `dsh-sdk` (the bare
  `sdk` read ambiguously in configs); READMEs, config catalog, fixture,
  and suites follow. The Loader fixture now omits providerName to exercise
  the shipped default end to end.
- loader-composition.e2e: two full harness runtimes boot in sequence, so
  the default 30s loader-smoke window times out under host load; raise the
  subprocess deadline to 120s with matching vitest headroom (the
  real-model.e2e precedent).

examples/jsonrpc-agent/tests/fixtures/subagent/subagent-sdk/cordis.yml

@@ -12,10 +12,11 @@
 - id: subagent
   name: '@deepseek-ai/dsh-subagent'
 
+# providerName is omitted: the composition exercises the shipped default
+# (`dsh-sdk`) through the real Loader.
 - id: subagent-sdk
   name: '@deepseek-ai/dsh-subagent-sdk'
   config:
-    providerName: sdk
     command: !!js process.env.DSH_TEST_CHILD_COMMAND
     args: !!js JSON.parse(process.env.DSH_TEST_CHILD_ARGS ?? '[]')
     provider: mock
@@ -25,7 +26,7 @@
 - id: tool-subagent
   name: '@deepseek-ai/dsh-tool-subagent'
   config:
-    provider: sdk
+    provider: dsh-sdk
     toolName: subagent
     # The SDK backend advertises no depthLimit: the child harness owns its own
     # recursion budget, so the local numeric default cannot apply here.