docs: clarify API key placeholders and safe diagnostic sharing

[Zen-cronic]

Summary

Use <YOUR_CALLE_API_KEY> in README and CONTRIBUTING and clarify that example API keys are non-working placeholders and that a sample prefix must not define credential validation or redaction. README adds guidance for secret values, phone fields, and free-text call data, with a redacted diagnostic excerpt. CONTRIBUTING uses the same placeholder and links that guidance; CHANGELOG records the documentation change.

Refs CALLE-AI/awesome-phone-call-agents#344.

Documentation only. SDK behavior, API contract, and package version are unchanged; registry documentation updates with a subsequent package release.

Validation

On September 15, 2026, ran the existing TypeScript and Python create-and-wait examples locally against the real service with the official authorized test hotline and SDK source version 0.7.1. TypeScript used Node 26.7.0; Python used Python 3.12.14. Both commands returned zero and a completed call. The identical request and demo idempotency key returned the same Call ID: one attempt with seven transcript turns, completed_count: 1, and can_attend: unknown. Both SDKs preserved the original task text. Credentials and call data are excluded from this PR.

This validates the credential setup and call-to-result flow. Goal Runs, webhook examples, universal key-prefix rules, automated redaction, and real meeting availability were not validated. The JSON excerpt is illustrative redacted data, not an executable request.

GitHub Markdown rendering and visual inspection passed for both README sections. git diff --check passed.

Checklist

• I kept this change within the documented server SDK scope.
• I did not add browser/client-side patterns that expose CALL-E API keys.
• I did not include private collaboration links or unconfirmed public repository references.
• I updated the relevant documentation.
• I updated the changelog.
• I ran the relevant local checks.

Local checks

pnpm run validate passed: OpenAPI verification, 36 tests, type checks, example type checks, release-version checks, public-repository hygiene, package build, and tarball installation smoke test. pnpm run example:create-and-wait completed the real-service validation described above.