docs: bilingual credentials/settings-consumer documentation, catalogs, and gates

New credentials data-structure page (type-equiv manifested), group README,
rewritten llm-deepseek/llm-pi-ai READMEs (dynamic configuration, dict
profiles, credential chain), capability-seams/service-role registration,
Agent Note (bilingual), demo compositions mounting settings-local +
credentials-local with no inline key plumbing, installSettingsSection
consumer helper on the settings seam (deduplicating both adapters' wiring),
jscpd symmetry markers for the provider twins, runtime-closure additions for
python/sdk-runtime, and doc-budget ceilings AGENTS.md 1750→1755 /
packages/README.md 850→865 for the structural one-line group rows.

examples/headless-agent/credentials.cordis.snapshot.yml

@@ -1,6 +1,6 @@
-# Keyless dynamic-configuration composition: the settings and credentials
-# providers live under the run cwd, no API key exists anywhere, and the
-# deepseek route still registers — so the prompt fails with the actionable
+# Keyless dynamic-configuration composition: the base settings and credentials
+# providers see only the isolated run home, no API key exists anywhere, and
+# the deepseek route still registers — so the prompt fails with the actionable
 # MISSING_CREDENTIAL guidance this snapshot pins as first-run UX.
 - id: base
   name: '@cordisjs/plugin-include'
@@ -11,15 +11,6 @@
         name: '@deepseek-ai/dsh-llm-deepseek'
         disabled: true
       - insert:
-          - id: settings
-            name: '@deepseek-ai/dsh-settings-local'
-            config:
-              dshHome: ./.dsh
-              debounceMs: 10
-          - id: credentials
-            name: '@deepseek-ai/dsh-credentials-local'
-            config:
-              dshHome: ./.dsh
           # The endpoint is never dialed: credential resolution fails first.
           - id: llm-deepseek-keyless
             name: '@deepseek-ai/dsh-llm-deepseek'