docs(cli-registry): annotate overlays.credStore as declared-for-later

Review item 4 named THREE live tables duplicating registry data. Two are now
read from the entry (`defaultRemoteCommandForMode`, `defaultDockerCommandForMode`);
the third, `resolveDockerCredentialArtifacts`, is not — and it was left neither
wired nor annotated, which is the state that item explicitly rules out.

It is not wired because the shape cannot express the live table: `credStore` is
ONE store per CLI, and `CRED_STORES` needs two for gemini (`.gemini` for the
CLI's own auth plus `.config/gcloud` for Vertex), while deepseek's entry declares
none at all even though `.dsh` is seeded. Wiring it means making the field an
array and correcting those two entries — a change to credential seeding, which
is at once the worst thing in that file to get wrong and the least covered by
tests, since every docker IO path is no-op'd under vitest. It belongs in its own
change, measured against a real container.

So it is annotated instead, at the field, in the type's declared-for-later
header, in docs/cli-registry.md, and in the pinned DECLARED_FOR_LATER list — the
last of which means wiring it later makes a test fail rather than leaving a
stale comment behind.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WQkoi1cNegqVwZHgzx5SbJ

test/cli-registry-no-id-branching.test.ts

@@ -315,6 +315,9 @@ describe('declared-for-later fields', () => {
     'capabilities.wheelForward',
     'capabilities.keyboardAccessory',
     'capabilities.maxFrameBytes',
+    // The Docker credential-seeding path still reads its own CRED_STORES table: this shape
+    // allows ONE store per CLI and the live table needs two for gemini. See CliOverlays.
+    'overlays.credStore',
   ];
 
   /** Read every `.ts` under src/, minus the registry itself (which of course names them). */