Add examples/coding-agent and the docs cookbook

The first real agent wiring: DeepSeek V4 + the bash tool suite + stdio
chat + JSONL persistence, runnable via yarn demo:coding (reads the
gitignored repo-root .env through process.loadEnvFile).

- examples/coding-agent: cordis.yml wiring both real plugin families
  (llm-deepseek with !!js env secrets; bash-local + tool-bash), a
  bash-only coding system prompt, a max-steps-guard plugin (bounds
  runaway turns via the agent/turn-continuation waterfall — abort()
  from step-end is a no-op by then), and a stdio UI with dimmed
  reasoning and exit-on-idle for piped stdin.
- e2e (yarn test:e2e, key-gated): full-loop.e2e.ts runs a real model
  against the real bash tool; coding-task.e2e.ts is the swebench-style
  smoke — the model fixes a buggy add.js in a temp dir and the test
  re-runs node add.test.js itself rather than trusting the agent.
- docs/cookbook: adding-a-package (the verified checklist),
  adding-a-tool (execute() contract, background pattern, seams),
  adding-an-llm-adapter (protocol obligations, mock-server testing,
  e2e policy). AGENTS.md layout/commands/secrets sections updated;
  architecture.md points at both examples and the cookbook.
- vitest.e2e.config.ts: serialize test files + retry twice — parallel
  e2e files trip the shared internal key's concurrency quota.
- fix: the !js YAML tag spelling in docs/JSDoc is actually !!js
  (js-yaml resolves custom tags under tag:yaml.org,2002:js).

docs/cookbook/adding-a-package.md

@@ -0,0 +1,55 @@
+# Cookbook: adding a workspace package
+
+The file-by-file checklist for a new `@deepseek-ai/dsh-<name>` package.
+(Verified by the bash and adapter packages; if it drifts, fix it here.)
+
+## 1. Create the package
+
+```
+packages/<name>/
+  package.json     # copy from packages/tools, adjust name/description/deps
+  tsconfig.json    # extends ../../tsconfig.base.json, rootDir src, outDir lib,
+                   # references: vendor/cosmokit, vendor/cordis (+ vendor/schemastery
+                   # if you use Config, + ../<dep> for each dsh dependency)
+  src/index.ts     # service default export or plugin (name/inject/apply/Config)
+  tests/<x>.spec.ts
+  README.md        # service API, events, extension points, design notes
+```
+
+package.json invariants (enforced by `yarn constraints` / yarn.config.cjs):
+`private: true`, `version: 0.0.1`, `type: module`, `cordis` in BOTH
+peerDependencies and devDependencies (same range). Mirror every dsh peer
+dependency in devDependencies. `schemastery` goes in `dependencies` (it is a
+runtime validator), matching agent-loop.
+
+## 2. Register it in the root configs
+
+| File | Change |
+|---|---|
+| `tsconfig.base.json` | add `"@deepseek-ai/dsh-<name>": ["./packages/<name>/src"]` to `paths` |
+| `tsconfig.typecheck.json` | same entry (this file overrides the map wholesale) |
+| `tsconfig.build.json` | add `{ "path": "./packages/<name>" }` to `references` |
+| `scripts/publint-all.ts` | add `'packages/<name>'` to the array |
+| `knip.json` | only if the package has non-`*.spec.ts` entries (e.g. `*.e2e.ts` → add a per-workspace override like `packages/llm-deepseek`) |
+
+Covered automatically by globs — no edits needed: root `package.json`
+workspaces, `tsdown.config.ts`, `vitest.config.ts`, `eslint.config.mjs`.
+
+## 3. Decide the package topology
+
+For a swappable capability, split interface / implementation / consumer into
+separate packages (see docs/architecture.md § "Capability seams" — the bash
+trio is the template). A single-purpose plugin stays one package.
+
+## 4. Verify
+
+```sh
+yarn install        # registers the workspace
+yarn constraints && yarn typecheck && yarn lint
+yarn test:coverage  # 100% per-file over src (types.ts exempt)
+yarn build && yarn knip && yarn publint
+```
+
+Test expectations: every registry/registration needs an HMR-safety test
+(register from a child fiber, dispose it, assert cleanup). Excessive tests
+are welcome — see AGENTS.md.