dsh-kubectl-guard: Gating kubectl Operations Based on kubeconfig Context

dsh-kubectl-guard is a policy plugin for DeepSeek Harness designed to prevent large models from performing irreversible `kubectl` operations on non-local clusters by intercepting Shell tool calls. It blocks `delete` commands on non-local clusters, requires confirmation for write operations such as `apply` on non-local clusters, and allows read operations and operations on local clusters. The plugin works by parsing command strings and is well suited as a safety backstop against “confused agents.”