fix: remove one machine's addresses and paths from the shipped defaults

The plugin was developed against an Ollama on a private LAN address, and that
address had reached places that ship:

- the `config` parameter description the MODEL reads on every request;
- the commented example in `cordis.patch.yml`, the layer every profile applies;
- `scripts/smoke.mjs` and `scripts/measure.mjs` endpoint defaults;
- both measure scripts' default workspace, which was an absolute local path
  and named a private repository;
- README examples and test fixtures.

All of them now use `http://127.0.0.1:11434`, which is Ollama's documented
default and belongs to no particular machine — kept rather than emptied because
`validateSettings` requires an http(s) URL, so an empty default would turn every
call into INVALID_SETTINGS until someone configured it. Test fixtures use
192.0.2.10 instead: TEST-NET-1 is reserved for documentation and cannot point at
a host anybody runs. The `focus` and `config` examples are generic, and the
workspace defaults are the working directory.

Two script bugs surfaced once the defaults stopped pointing at a live box, and
are fixed here. `measure.mjs` built its own configuration literal, which was ten
fields short of the schema — harmless while nothing validated it, and a refused
call the moment `execute` began checking the section it was handed; it now
resolves its configuration through the plugin's own `Config`, so it cannot drift
again. It also crashed on a failed search (`first.index.scanned` of a result
that has no index) instead of reporting the endpoint it could not reach, which
is now the ordinary case. `scope-measure.mjs` divided by a scope that does not
exist in any workspace without focus markers, and now says so.

Also corrects `cordis.patch.yml`'s description of what the row registers: in
0.1.7 the exported `Config` is the settings registration, not a namespace on
`ctx.settings`.

cordis.patch.yml

@@ -1,7 +1,9 @@
 # The layer this bundle contributes to a dsh profile that lists it.
 #
 # One row: the dsh-recall host plugin, which registers exactly one tool
-# (`recall`) on `ctx.tools` and one settings namespace on `ctx.settings`.
+# (`recall`) on `ctx.tools`. Its settings are the `Config` schema it exports —
+# the Harness keys a form per profile entry by this row's id — so there is no
+# section to register and nothing to attach at load.
 #
 # There is deliberately NO `config:` block. Every value the plugin needs is
 # either discovered at runtime (the workspace, from the calling session) or
@@ -14,7 +16,7 @@
 #   - id: dsh-recall
 #     name: dsh-recall
 #     config:
-#       embeddingApiBase: http://10.50.1.2:11434
+#       embeddingApiBase: http://127.0.0.1:11434   # replace with your endpoint
 
 - insert:
     - id: dsh-recall