[DeepSeek Harness 5/8] Run DeepSeek Harness through managed inference without provider credentials

## Summary

Route every supported DeepSeek Harness model call through NemoClaw managed inference without placing the upstream provider credential or an alternate direct-provider route inside the sandbox.

Parent epic: #9328

Depends on:

- #9329, **[DeepSeek Harness 1/8] Accept product scope, ownership, threat model, and compatibility matrix**;
- #9330, **[DeepSeek Harness 2/8] Produce a reproducible DeepSeek Harness candidate runtime**.

#9331 consumes this contract. #9335 owns exact-candidate live qualification.

The Gate 1 decision is authoritative for the supported adapter, API family, provider classes, model-validation rules, context and output limits, reasoning behavior, streaming behavior, and tool-call requirements. The current starting candidate is DSH's generic `llm-pi-ai` adapter using `openai-completions`, `https://inference.local/v1`, and `nvidia/nemotron-3-super-120b-a12b` for release qualification. This issue must not silently turn those planning candidates into a permanent contract or model allowlist.

## Problem Statement

DeepSeek Harness ships with direct DeepSeek-provider configuration, a local credential store, user- and profile-controlled model settings, and tools that may establish additional model or search routes. Those defaults are not the NemoClaw managed-inference boundary.

The DSH local credential file is readable by same-UID tool processes and therefore cannot hold the upstream provider credential in a supported NemoClaw sandbox. A user setting, project profile, restored file, Web settings action, or plugin must not replace the managed route after startup. Web and headless execution must also agree on the same live model configuration rather than retaining independent or stale routes.

## Desired Behavior

NemoClaw generates a compute-runtime-neutral DSH inference overlay from the selected provider bundle and installs a root-owned final authority layer after all untrusted user, project, profile, and restored inputs are considered.

Every accepted DSH surface sends model traffic through the supported `inference.local` route. OpenShell retains the upstream provider credential. The sandbox receives only the non-secret placeholder or route material explicitly required by the accepted managed-inference contract, with no authority to call the upstream provider directly.

The selected model is validated against the provider catalog and the capabilities DSH requires. NemoClaw maps the accepted model ID, API family, context window, output limit, reasoning controls, streaming requirements, and structured tool-call behavior into DSH configuration. Unsupported combinations fail before an agent session begins with a stable, actionable error.

## Scope

- Map accepted NemoClaw provider bundles and API families into one managed DSH adapter configuration.
- Generate one final configuration authority shared by the accepted Web and headless surfaces.
- Validate model identity and required context, output, reasoning, streaming, and structured tool-call capabilities.
- Prevent DSH settings, profile patches, project resources, restored files, plugins, or environment variables from replacing the managed route.
- Disable or fail closed on direct native-provider fallback, direct DeepSeek search/model traffic, and any unaccepted secondary model route.
- Keep DSH credential files free of upstream provider credentials.
- Refresh the live DSH configuration after a supported route change, restart, rebuild, restore, or recovery operation.
- Redact model-route and credential-bearing material from logs, status, diagnostics, snapshots, and qualification evidence.
- Produce deterministic configuration, security, and integration tests consumed by Gate 7.

## Required tests and evidence

The implementation PR must add repository-owned tests for the following observable behavior:

1. A generated configuration fixture records the accepted adapter, API family, base URL, model, limits, and behavior flags exactly.
2. A precedence test supplies conflicting user settings, project profiles, environment values, restored configuration, and Web settings mutations. The final live route remains managed or startup fails closed.
3. Web and headless test fixtures issue a streamed model turn with a structured tool call through the same managed route and model identity.
4. A route observer or managed-inference receipt proves that requests reached `inference.local`; an agent assertion is not sufficient evidence.
5. Direct DeepSeek-provider, search, telemetry-adjacent model, and arbitrary external OpenAI-compatible destinations remain unavailable unless Gate 1 explicitly accepts them.
6. A synthetic upstream credential canary remains absent from OCI layers, process environments, DSH credential files, user state, registry records, stdout/stderr, logs, diagnostics, snapshots, and evidence artifacts.
7. A route change followed by restart and rebuild uses only the new accepted route and leaves no stale model authority in either surface.
8. Invalid provider, API-family, model, request-shape, and tool-call combinations return stable actionable errors without attempting direct fallback.

Evidence must identify the exact NemoClaw commit, DSH package version and integrity, managed-image digest, architecture, adapter, API family, selected provider and model, generated-configuration digest, policy digest, test version, route-observer result, and credential-canary scan result. Evidence must be bounded and secret-free.

## Documentation

- Document the managed adapter and API-family contract, credential-custody boundary, model-validation behavior, configuration precedence, and route-change behavior in the contributor/runtime documentation.
- Add or update actionable user-facing error text for unsupported providers, models, request shapes, and attempted route overrides.
- Supply the exact supported inference and troubleshooting facts that Gate 8 must publish. Do not advertise DeepSeek Harness as supported before Gate 8 activates it.

## Constraints and Non-goals

- Do not write the upstream provider credential into the image, sandbox filesystem, process environment, DSH credential store, registry, logs, snapshot, diagnostics, or evidence.
- Do not permit settings, profile patches, project resources, plugins, restored state, or the Web UI to override the final managed route.
- Do not silently fall back to a native DeepSeek provider or another direct endpoint.
- Do not enable direct DeepSeek web search merely because the harness includes it.
- Do not use the release qualification model as a permanent model allowlist.
- Do not add a DeepSeek Harness-specific inference provider abstraction when the shared provider-bundle contract is sufficient.
- Do not add Docker-, architecture-, or host-local-inference behavior to DSH-specific configuration.
- Do not claim compatibility for an API family, provider, or model without the Gate 1 validation rules and evidence.

## Acceptance Criteria

- [ ] Every accepted DeepSeek Harness surface uses the Gate 1 managed adapter and `inference.local` route.
- [ ] A route-side observer proves both Web and headless model turns use the recorded provider, model, and API family.
- [ ] The final root-owned configuration authority wins over or rejects conflicting user, project, profile, plugin, restored, environment, and Web settings inputs.
- [ ] The managed image and running sandbox contain no upstream provider credential.
- [ ] `$DSH_HOME/.credentials.yaml` and all other DSH state contain no upstream provider credential.
- [ ] Direct provider fallback and every unaccepted secondary model or search route fail closed.
- [ ] Accepted reasoning, streaming, context/output limits, and structured tool calls pass deterministic compatibility tests.
- [ ] Unsupported providers, API families, models, and request shapes fail before a session with stable actionable errors.
- [ ] Route change, restart, rebuild, restore, and recovery do not resurrect stale inference configuration.
- [ ] DSH inference configuration contains no compute-runtime or architecture branch.
- [ ] Credential-canary tests cover images, environments, files, registry state, logs, diagnostics, snapshots, and evidence.
- [ ] The repository-owned evidence record includes every exact identity and result listed above and contains no credential.
- [ ] Contributor documentation records the inference contract and Gate 8 has the verified user-facing support facts it needs.

## Category

Provider

## Checklist

- [x] I searched existing issues and this is not a duplicate.
- [x] I described the problem and desired behavior.

Start with the Gate 1 decision and dependencies #9329 and #9330, then trace the managed-inference contract across Web and headless execution. Use the required repository-owned configuration, precedence, route-observer, credential-canary, compatibility, and restart/rebuild tests as the work map; done means all listed acceptance criteria pass with bounded, secret-free evidence.

Written by the indexing model from the issue text.