feat: add DeepSeek Harness and Kimi MCP routing

[zzAllenn]

What changed

• teach the one-line macOS/Linux and Windows installers to detect DSH, install the AgentKey skill globally, and invoke the DSH device-code MCP writer without passing dsh to skills add -a
• remove only top-level AgentKey managed blocks during uninstall while preserving marker-prefix collisions, YAML block scalars, malformed blocks, and unrelated patches
• add a DSH-specific Skill setup branch explaining why DSH rc.7 must use device-code Bearer authentication instead of generic MCP OAuth
• document the home-level patch, safe legacy migration, symlink-profile behavior, HMR limits, tool-policy limits, and actual readiness checks in English and Chinese
• route the Kimi plugin through the client-attributed https://api.agentkey.app/kimi/v1/mcp alias while keeping its native OAuth flow and the same AgentKey MCP surface
• add macOS/Linux Bats coverage, an attributed endpoint contract, and a Windows PowerShell marker regression gate

Why

DSH users need one global AgentKey integration across current and future profiles without selecting an AgentKey preset. DSH 0.1.0-rc.7 cannot complete the generic header-free MCP OAuth flow, so the public setup and self-repair guidance must consistently route DSH through @agentkey/cli --auth-login --only dsh.

Kimi uses a client-attributed MCP path so Server telemetry and routing can identify the originating client without changing Kimi's OAuth or tool behavior.

User impact

After the Server and CLI dependency are released, DSH users can run the normal one-line installer or the documented two-step flow. They verify success by checking the agentkey Loader row and then calling find_tools, describe_tool, and execute_tool; Mounted/active alone is not treated as a successful MCP connection.

Kimi plugin users continue to authenticate with the existing native OAuth command; only the remote path changes to the attributed alias.

Validation

• bats tests/ (41/41)
• bash -n scripts/install.sh
• bash -n scripts/uninstall.sh
• Windows marker regression is configured on windows-latest
• git diff --check

Release dependency

• Server/CLI implementation: https://github.com/chainbase-labs/AgentKey-Server/pull/241
• deploy and verify the Server routes first
• publish and canary @agentkey/cli@1.0.4 second
• release these installers, Skill changes, Kimi route, and public documentation last

This is a CLI-managed DSH MCP integration, not a native installable DSH plugin.