Merge remote-tracking branch 'origin/master' into stack/agent-profiles-1-seam

# Conflicts:
#	docs/capability-seams.md
#	docs/event-producer-consumer.md
#	packages/README.i18n.yaml
#	packages/ui/app-boot/README.i18n.yaml
#	packages/ui/app-boot/src/index.ts
#	scripts/doc-budgets.manifest.json

python/sdk-runtime/package.json

@@ -26,6 +26,7 @@
     "@deepseek-ai/dsh-compact-basic": "workspace:^",
     "@deepseek-ai/dsh-compact-tool-result-prune": "workspace:^",
     "@deepseek-ai/dsh-credentials": "workspace:^",
+    "@deepseek-ai/dsh-environment": "workspace:^",
     "@deepseek-ai/dsh-fs": "workspace:^",
     "@deepseek-ai/dsh-fs-local": "workspace:^",
     "@deepseek-ai/dsh-fs-policy": "workspace:^",
@@ -94,6 +95,7 @@
     "@deepseek-ai/dsh-tool-web": "workspace:^",
     "@deepseek-ai/dsh-tool-workflow": "workspace:^",
     "@deepseek-ai/dsh-tools": "workspace:^",
+    "@deepseek-ai/dsh-type-meta": "workspace:^",
     "@deepseek-ai/dsh-user-approval": "workspace:^",
     "@deepseek-ai/dsh-user-interaction": "workspace:^",
     "@deepseek-ai/dsh-web": "workspace:^",

python/sdk-runtime/src/deepseek_harness_runtime/runtime/cordis.yml

@@ -13,13 +13,12 @@
     workspaceContext:
       maxBytes: 65536
 
-# Stock DeepSeek adapters. Loading requires an API key; initialize and shutdown
-# may use a dummy key because they do not call the model.
+# Stock DeepSeek adapters. The adapter resolves DEEPSEEK_API_KEY through the
+# credential seam and, with no provider mounted here, from the launching
+# environment; DEEPSEEK_BASE_URL follows the same environment ladder. Neither
+# is inlined, so this file names no secret and no route.
 - id: llm-deepseek
   name: '@deepseek-ai/dsh-llm-deepseek'
-  config:
-    apiKey: !!js process.env.DEEPSEEK_API_KEY
-    baseURL: !!js process.env.DEEPSEEK_BASE_URL
 
 # JSONL persistence; $DSH_SESSION_ROOT wins over ./.sessions in the process cwd.
 - id: sessions