feat: implement Step 1 onboarding readiness

[Lee-take]

Summary

• add a dedicated Windows DPAPI DeepSeek credential vault, non-secret verification receipts, frozen error mapping, and one Kernel-owned readiness resolver
• add secret-free onboarding, workspace setup/readiness doctor, writable probes, V4 Flash/Pro checks, and legacy work-package-safe projections
• converge active smoke defaults to V4 Flash and require verified isolated APPDATA/LOCALAPPDATA profiles for installed/candidate UI smoke
• add focused offline Rust/Node coverage and CI contract gates

Verification

• node scripts/settings-panel.test.mjs
• node scripts/onboarding-readiness.test.mjs
• node scripts/windows-installed-ui-smoke.mjs --self-test
• node scripts/release-local-check.mjs --self-test
• npx pnpm@9.15.9 --filter @deepseek-agent-os/desktop build
• cargo fmt --manifest-path apps/desktop/src-tauri/Cargo.toml -- --check
• focused Rust credential/workspace/work-package/model/pricing/command-surface tests
• npx pnpm@9.15.9 test (892 passed, 7 ignored live-only tests)
• npx pnpm@9.15.9 test:release-source
• node scripts/secret-scan.mjs
• git diff --check
• git diff --cached --check

Scope

C1B only. No installer build or installation, no live DeepSeek credential or request, no main merge, and no tag or Release action.