Snapshot replays now supply a placeholder DEEPSEEK_API_KEY through the shared
REPLAY_CREDENTIAL_ENV, so web_search visibility no longer depends on whether
the runner exports a key. The new web-search-unconfigured headless scenario
pins a request without web_search, the headless keyless smoke asserts the
same through the real Loader, and subagent-dsh-sdk-dynamic-route's keyless
dsh-sdk child now records its tool list without web_search.