feat(dev-tools): document dsh install and zero-LLM local checks

Pin @deepseek-ai/dsh@0.1.1-rc.2 probing in check-dsh-executor-local.mjs,
keep live headless smoke opt-in only, and record the 10k-token approval gate.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/context-runtime-local-dev.md

@@ -59,6 +59,9 @@ node scripts/check-mcp-compactor-local.mjs
 
 # codebase-memory-mcp CLI + Memind 索引（见 docs/codebase-memory-mcp-local.md）
 node scripts/check-codebase-memory-mcp-local.mjs
+
+# dsh CLI + dry-run launch plan（见 docs/dsh-executor-local.md，默认零 LLM）
+node scripts/check-dsh-executor-local.mjs
 ```
 
 ## 用户自测清单（有 LLM 配额时）
@@ -86,6 +89,7 @@ ORDER BY created_at;
 ## 禁止项
 
 - Agent **不得**自动设置 `GOOSE_V149_ALLOW_REAL_LLM=1` 或循环跑 phase2/phase3
+- **预计超过 10k token 的 LLM 调用须用户明确同意**（含 dsh headless / Goose smoke）
 - **禁止** `headroom wrap` / `headroom learn` / `HEADROOM_OUTPUT_SHAPER=1`
 - 页面生成 / Page Data 轮次首期 **排除** headroom active