docs: bilingual credentials/settings-consumer documentation, catalogs, and gates

New credentials data-structure page (type-equiv manifested), group README,
rewritten llm-deepseek/llm-pi-ai READMEs (dynamic configuration, dict
profiles, credential chain), capability-seams/service-role registration,
Agent Note (bilingual), demo compositions mounting settings-local +
credentials-local with no inline key plumbing, installSettingsSection
consumer helper on the settings seam (deduplicating both adapters' wiring),
jscpd symmetry markers for the provider twins, runtime-closure additions for
python/sdk-runtime, and doc-budget ceilings AGENTS.md 1750→1755 /
packages/README.md 850→865 for the structural one-line group rows.

packages/credentials/credentials/README.md

@@ -13,8 +13,11 @@ Abstract credential seam (`ctx.credentials`). One doctrine, three consequences:
 ## Surface
 
 ```ts
+import type { Context } from 'cordis'
 import { credentialRef } from '@deepseek-ai/dsh-credentials'
 
+declare const ctx: Context
+
 const ref = credentialRef('DEEPSEEK_API_KEY')            // POSIX shell identifier, branded
 const hit = await ctx.credentials.resolve(ref)           // { value, source } | undefined
 const info = await ctx.credentials.describe(ref)         // { configured, source?, writable } — never the value
@@ -32,7 +35,7 @@ The shadowing rule on `set`/`unset` is deliberate fail-loud: when a read-only so
 
 ## Model Experience
 
-Indirectly: a resolved value authorizes provider requests; the consuming adapter owns every model-visible surface.
+Indirectly, through the consuming LLM adapters: a resolved value authorizes their provider requests, and the adapter owns every model-visible surface.
 
 #### KV Cache effect