docs: bilingual credentials/settings-consumer documentation, catalogs, and gates

New credentials data-structure page (type-equiv manifested), group README,
rewritten llm-deepseek/llm-pi-ai READMEs (dynamic configuration, dict
profiles, credential chain), capability-seams/service-role registration,
Agent Note (bilingual), demo compositions mounting settings-local +
credentials-local with no inline key plumbing, installSettingsSection
consumer helper on the settings seam (deduplicating both adapters' wiring),
jscpd symmetry markers for the provider twins, runtime-closure additions for
python/sdk-runtime, and doc-budget ceilings AGENTS.md 1750→1755 /
packages/README.md 850→865 for the structural one-line group rows.

examples/headless-agent/composition.md

@@ -8,6 +8,10 @@ The headless demo combines the real DeepSeek adapter and coding capabilities wit
 ```mermaid
 flowchart LR
   cfg["examples/headless-agent<br/>cordis.yml"]
+  plugin_headless_settings["settings<br/>@deepseek-ai/dsh-settings-local"]
+  cfg --> plugin_headless_settings
+  plugin_headless_credentials["credentials<br/>@deepseek-ai/dsh-credentials-local"]
+  cfg --> plugin_headless_credentials
   plugin_headless_llm_deepseek["llm-deepseek<br/>@deepseek-ai/dsh-llm-deepseek"]
   cfg --> plugin_headless_llm_deepseek
   plugin_headless_subprocess["subprocess<br/>@deepseek-ai/dsh-subprocess-local"]
@@ -55,6 +59,8 @@ flowchart LR
 
 | Plugin id | Package / module |
 | --- | --- |
+| `settings` | `@deepseek-ai/dsh-settings-local` |
+| `credentials` | `@deepseek-ai/dsh-credentials-local` |
 | `llm-deepseek` | `@deepseek-ai/dsh-llm-deepseek` |
 | `subprocess` | `@deepseek-ai/dsh-subprocess-local` |
 | `bash` | `@deepseek-ai/dsh-bash-local` |

examples/headless-agent/cordis.yml

@@ -1,16 +1,27 @@
 # One-shot coding agent with format-pure stdout. The app bin loads the
-# gitignored root `.env`; this file reads `DEEPSEEK_API_KEY` and optional
-# `DEEPSEEK_BASE_URL` through `!!js`.
+# gitignored root `.env` into the process environment; entry configs here are
+# the composition base, while user-plane values resolve per request through
+# the two providers below.
+
+# User-settings document (`$DSH_HOME/settings.yaml`, hot-reloaded): a
+# `llm-deepseek:` section there overrides the adapter entry below without a
+# restart.
+- id: settings
+  name: '@deepseek-ai/dsh-settings-local'
+
+# Credential store: the live process environment over `$DSH_HOME/.env`
+# (owner-only file, hot-reloaded). The adapter resolves `DEEPSEEK_API_KEY`
+# through it at each request, so no key is inlined in this file.
+- id: credentials
+  name: '@deepseek-ai/dsh-credentials-local'
 
 # The DeepSeek adapter. Swap to '@deepseek-ai/dsh-llm-pi-ai' for the pi-ai-backed
-# twin (same config shape; `reasoning: high` replaces thinking/reasoningEffort).
-# Shipped default: full thinking at max effort on every request (wire-only
-# defaults; they never enter the request header).
+# twin (a `providers` dict keyed by route; `reasoning: high` replaces
+# thinking/reasoningEffort). Shipped default: full thinking at max effort on
+# every request (wire-only defaults; they never enter the request header).
 - id: llm-deepseek
   name: '@deepseek-ai/dsh-llm-deepseek'
   config:
-    apiKey: !!js process.env.DEEPSEEK_API_KEY
-    baseURL: !!js process.env.DEEPSEEK_BASE_URL
     thinking: enabled
     reasoningEffort: max
     models:

examples/headless-agent/credentials.cordis.snapshot.yml

@@ -1,6 +1,6 @@
-# Keyless dynamic-configuration composition: the settings and credentials
-# providers live under the run cwd, no API key exists anywhere, and the
-# deepseek route still registers — so the prompt fails with the actionable
+# Keyless dynamic-configuration composition: the base settings and credentials
+# providers see only the isolated run home, no API key exists anywhere, and
+# the deepseek route still registers — so the prompt fails with the actionable
 # MISSING_CREDENTIAL guidance this snapshot pins as first-run UX.
 - id: base
   name: '@cordisjs/plugin-include'
@@ -11,15 +11,6 @@
         name: '@deepseek-ai/dsh-llm-deepseek'
         disabled: true
       - insert:
-          - id: settings
-            name: '@deepseek-ai/dsh-settings-local'
-            config:
-              dshHome: ./.dsh
-              debounceMs: 10
-          - id: credentials
-            name: '@deepseek-ai/dsh-credentials-local'
-            config:
-              dshHome: ./.dsh
           # The endpoint is never dialed: credential resolution fails first.
           - id: llm-deepseek-keyless
             name: '@deepseek-ai/dsh-llm-deepseek'