docs: say where the API key goes before the first request fails

[agentforce314]

Install ends at dsh --profile dsh-cctui, and the next thing a new user meets is
MISSING_CREDENTIAL — with nothing in this README saying where a key belongs. The harness
resolves one per request through dsh-credentials-local, so the answer was only ever in that
package's own docs, a dependency-of-a-dependency away from anyone reading this one.

Adds an API key subsection under Install, recording the managed store
($DSH_HOME/.credentials.yaml) as the recommended home plus the three facts that are easy to get
wrong on the way there:

• the 0600 mode is enforced, not advisory — the provider refuses a document carrying any group
  or other permission bit and fails at boot
• the document is watched, so a key stored mid-session takes effect on the next request
• the key never belongs in cordis.patch.yml — adapter config carries apiKeyEnv, a reference,
  not a secret

Also states the layer precedence (launching environment > store > <cwd>/.env > ~/.dsh/.env),
that one key covers web_search too, and what 0600 does not buy: it stops other OS users, not
the model, whose bash and filesystem tools run as the same user.

Every claim was checked against the booted profile (dsh --profile dsh-cctui --dump-config
mounts dsh-credentials-local and dsh-llm-deepseek with the default
apiKeyEnv: DEEPSEEK_API_KEY) and against those packages' READMEs, and the documented path was
walked end to end on a real key.

Docs only, so no version bump — matching 69ae70d, 52c365c, and faa956d.

🤖 Generated with Claude Code