dsh-guard-sensitive-paths: DeepSeek Harness Sensitive Path Approval Plugin

The DeepSeek Harness plugin `dsh-guard-sensitive-paths` uses a plugin-based architecture and registers a `tools/pre-execute` policy to intercept agent access to sensitive paths. Enabled by default with the highest priority, it mainly blocks write, modify, and execute operations on `.env`, `.git`, and `.ssh` directories, SSH private keys, and `.pem` certificates, as well as read operations on secret files. It supports scanning Bash command text and enforces approval when matches are detected. Once installed, it takes effect with zero configuration and helps prevent leakage of sensitive data, but it cannot intercept host-level sidecar behavior, network egress, or data transfers to model inference endpoints.