docs: bilingual credentials/settings-consumer documentation, catalogs, and gates

New credentials data-structure page (type-equiv manifested), group README,
rewritten llm-deepseek/llm-pi-ai READMEs (dynamic configuration, dict
profiles, credential chain), capability-seams/service-role registration,
Agent Note (bilingual), demo compositions mounting settings-local +
credentials-local with no inline key plumbing, installSettingsSection
consumer helper on the settings seam (deduplicating both adapters' wiring),
jscpd symmetry markers for the provider twins, runtime-closure additions for
python/sdk-runtime, and doc-budget ceilings AGENTS.md 1750→1755 /
packages/README.md 850→865 for the structural one-line group rows.

examples/headless-agent/cordis.yml

@@ -1,16 +1,27 @@
 # One-shot coding agent with format-pure stdout. The app bin loads the
-# gitignored root `.env`; this file reads `DEEPSEEK_API_KEY` and optional
-# `DEEPSEEK_BASE_URL` through `!!js`.
+# gitignored root `.env` into the process environment; entry configs here are
+# the composition base, while user-plane values resolve per request through
+# the two providers below.
+
+# User-settings document (`$DSH_HOME/settings.yaml`, hot-reloaded): a
+# `llm-deepseek:` section there overrides the adapter entry below without a
+# restart.
+- id: settings
+  name: '@deepseek-ai/dsh-settings-local'
+
+# Credential store: the live process environment over `$DSH_HOME/.env`
+# (owner-only file, hot-reloaded). The adapter resolves `DEEPSEEK_API_KEY`
+# through it at each request, so no key is inlined in this file.
+- id: credentials
+  name: '@deepseek-ai/dsh-credentials-local'
 
 # The DeepSeek adapter. Swap to '@deepseek-ai/dsh-llm-pi-ai' for the pi-ai-backed
-# twin (same config shape; `reasoning: high` replaces thinking/reasoningEffort).
-# Shipped default: full thinking at max effort on every request (wire-only
-# defaults; they never enter the request header).
+# twin (a `providers` dict keyed by route; `reasoning: high` replaces
+# thinking/reasoningEffort). Shipped default: full thinking at max effort on
+# every request (wire-only defaults; they never enter the request header).
 - id: llm-deepseek
   name: '@deepseek-ai/dsh-llm-deepseek'
   config:
-    apiKey: !!js process.env.DEEPSEEK_API_KEY
-    baseURL: !!js process.env.DEEPSEEK_BASE_URL
     thinking: enabled
     reasoningEffort: max
     models: