Add safe DeepSeek env helper

[SonAIengine]

Summary

• add a local helper that prompts for DEEPSEEK_API_KEY without accepting secrets as CLI args
• write the configured env var to a gitignored .env with mode 0600
• document the helper before the DeepSeek agent-loop benchmark command

Verification

• uv run pytest tests/test_deepseek_env_config.py tests/test_agent_search_benchmarks.py
• uv run ruff check examples/ablation/configure_deepseek_env.py examples/ablation/run_agent_loop_benchmarks.py tests/test_deepseek_env_config.py tests/test_agent_search_benchmarks.py
• git diff --check