dsh-plugin-sentinel: Static Security Auditor for DeepSeek Harness Plugins

In the DeepSeek Harness (DSH) ecosystem, `dsh-plugin-sentinel` is a zero-dependency static audit tool that parses tar archives in memory to detect potential risks in community plugins before installation. It relies on no scripts or build processes, using only Node.js built-in modules to parse `.tgz` files in memory and prevent malicious code from being written to disk. It supports lexical stripping scans and composite rule detection, performing security checks on `package.json`, source code, `cordis.patch.yml`, and tarball structure, covering high-risk indicators such as process execution, outbound network access, credential access, and path traversal. Audit results are classified by severity (pass/review/block), allowing the model to automatically block high-risk plugins before installation.