test: real-Loader dynamic composition, keyless onboarding snapshot, and .env-only e2e

llm-deepseek gains a Loader+Include composition spec proving external
settings.yaml/.env edits reach the very next request, and a real-API e2e
where only a credentials-local document holds the key. The headless example
pins the first-run missing-credential UX as a keyless stream-json snapshot
(new credentials.cordis.snapshot.yml scenario); runLoaderSmoke learns
expectedExitCode so a designed failure surface can be pinned instead of
masked.

examples/headless-agent/credentials.cordis.snapshot.yml

@@ -0,0 +1,27 @@
+# Keyless dynamic-configuration composition: the settings and credentials
+# providers live under the run cwd, no API key exists anywhere, and the
+# deepseek route still registers — so the prompt fails with the actionable
+# MISSING_CREDENTIAL guidance this snapshot pins as first-run UX.
+- id: base
+  name: '@cordisjs/plugin-include'
+  config:
+    path: ./cordis.yml
+    patches:
+      - id: llm-deepseek
+        name: '@deepseek-ai/dsh-llm-deepseek'
+        disabled: true
+      - insert:
+          - id: settings
+            name: '@deepseek-ai/dsh-settings-local'
+            config:
+              dshHome: ./.dsh
+              debounceMs: 10
+          - id: credentials
+            name: '@deepseek-ai/dsh-credentials-local'
+            config:
+              dshHome: ./.dsh
+          # The endpoint is never dialed: credential resolution fails first.
+          - id: llm-deepseek-keyless
+            name: '@deepseek-ai/dsh-llm-deepseek'
+            config:
+              baseURL: 'http://127.0.0.1:9'