feat: add DeepSeek Harness and Kimi MCP routing (#96)

## What changed

- teach the one-line macOS/Linux and Windows installers to detect DSH,
install the AgentKey skill globally, and invoke the DSH device-code MCP
writer without passing `dsh` to `skills add -a`
- remove only top-level AgentKey managed blocks during uninstall while
preserving marker-prefix collisions, YAML block scalars, malformed
blocks, and unrelated patches
- add a DSH-specific Skill setup branch explaining why DSH rc.7 must use
device-code Bearer authentication instead of generic MCP OAuth
- document the home-level patch, safe legacy migration, symlink-profile
behavior, HMR limits, tool-policy limits, and actual readiness checks in
English and Chinese
- route the Kimi plugin through the client-attributed
`https://api.agentkey.app/kimi/v1/mcp` alias while keeping its native
OAuth flow and the same AgentKey MCP surface
- add macOS/Linux Bats coverage, an attributed endpoint contract, and a
Windows PowerShell marker regression gate

## Why

DSH users need one global AgentKey integration across current and future
profiles without selecting an AgentKey preset. DSH 0.1.0-rc.7 cannot
complete the generic header-free MCP OAuth flow, so the public setup and
self-repair guidance must consistently route DSH through `@agentkey/cli
--auth-login --only dsh`.

Kimi uses a client-attributed MCP path so Server telemetry and routing
can identify the originating client without changing Kimi's OAuth or
tool behavior.

## User impact

After the Server and CLI dependency are released, DSH users can run the
normal one-line installer or the documented two-step flow. They verify
success by checking the `agentkey` Loader row and then calling
`find_tools`, `describe_tool`, and `execute_tool`; Mounted/active alone
is not treated as a successful MCP connection.

Kimi plugin users continue to authenticate with the existing native
OAuth command; only the remote path changes to the attributed alias.

## Validation

- `bats tests/` (41/41)
- `bash -n scripts/install.sh`
- `bash -n scripts/uninstall.sh`
- Windows marker regression is configured on `windows-latest`
- `git diff --check`

## Release dependency

- Server/CLI implementation:
https://github.com/chainbase-labs/AgentKey-Server/pull/241
- deploy and verify the Server routes first
- publish and canary `@agentkey/cli@1.0.4` second
- release these installers, Skill changes, Kimi route, and public
documentation last

This is a CLI-managed DSH MCP integration, not a native installable DSH
plugin.

---------

Co-authored-by: Allen <0xfatdog@gmail.com>

.github/workflows/scripts-test.yml

@@ -49,3 +49,11 @@ jobs:
             sudo apt-get update && sudo apt-get install -y bats
           fi
       - run: bats tests/
+
+  dsh-powershell-marker:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Preserve indented DSH block-scalar markers
+        shell: pwsh
+        run: ./tests/dsh-uninstall-marker.ps1