docs: bilingual credentials/settings-consumer documentation, catalogs, and gates

New credentials data-structure page (type-equiv manifested), group README,
rewritten llm-deepseek/llm-pi-ai READMEs (dynamic configuration, dict
profiles, credential chain), capability-seams/service-role registration,
Agent Note (bilingual), demo compositions mounting settings-local +
credentials-local with no inline key plumbing, installSettingsSection
consumer helper on the settings seam (deduplicating both adapters' wiring),
jscpd symmetry markers for the provider twins, runtime-closure additions for
python/sdk-runtime, and doc-budget ceilings AGENTS.md 1750→1755 /
packages/README.md 850→865 for the structural one-line group rows.

packages/util/atomic-write/README.md

@@ -9,6 +9,8 @@ Zero-dependency atomic file replacement shared by file-backed stores that must n
 ```ts
 import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write'
 
+declare const text: string
+
 await writeFileAtomic('/home/u/.dsh/settings.yaml', text, { mode: 0o600 })
 ```
 
@@ -24,6 +26,10 @@ One export. The contract, in the order failures would exploit it:
 
 None, as this is a pure filesystem primitive; nothing here reaches a model request.
 
+#### KV Cache effect
+
+None; nothing here enters a request prefix.
+
 ## Known Limitations and Deferred Work
 
 - **Atomic, not durable** — no `fsync` of the file or its directory, so after a crash the rename may be observed unwound. The file-backed stores here re-read and republish on boot, keeping durability the caller's policy.