refactor(llm-deepseek)!: rename the provider route to deepseek-official

The native adapter's route was named deepseek, colliding with pi-ai's
catalog provider of the same name, so the two DeepSeek paths could never
be mounted side by side. The web settings page needs both configurable at
once. Compositions, fixtures, goldens, scaffolding defaults, and docs all
move together (pre-release, no shim); TUI/session-query-spill/
missing-credential goldens re-recorded through their keyless refresh
modes because provider-name length shifts box padding and spill
truncation points.

examples/jsonrpc-agent/cordis.snapshot.yml

@@ -1,7 +1,7 @@
 # Keyless replay includes the live `cordis.yml`, disables the key-requiring
 # DeepSeek adapter, and inserts `llm-replay` to serve recorded JSONL without a
 # key or network; every other entry remains shared. The replay provider
-# catalog claims the `deepseek` provider so the SDK server's `initialize`
+# catalog claims the `deepseek-official` provider so the SDK server's `initialize`
 # finds it owned and never mounts the real-adapter fallback. The SDK snapshot
 # suite passes this path explicitly through `DSH_CORDIS_CONFIG` (the
 # jsonrpc-demo bin performs no DSH_SNAPSHOT config swap of its own), and
@@ -22,7 +22,7 @@
             name: '@deepseek-ai/dsh-llm-replay'
             config:
               providers:
-                - id: deepseek
+                - id: deepseek-official
                   name: DeepSeek
                   models:
                     - id: deepseek-v4-flash