dsh-tool-surface-proof: Deployment-Level Evidence of Model-Visible Tool Surface Consistency

The DeepSeek Harness (DSH) plugin `dsh-tool-surface-proof` is designed to verify that deployment-specific tool architecture conforms to approved locks, ensuring the actually recorded model-visible surface matches the expected one. It supports offline content-addressed evidence generation and can detect drift, such as missing surfaces, permission mismatches, or schema changes. The plugin provides CLI subcommands for inspection and validation, without executing commands or capturing live runtime state, and its reports include only SHA-256 identities and counts, without exposing tool names or business content.