dsh-allow: Fine-Grained DSH Filesystem Permission Control by Path and Capability

The DSH plugin dsh-allow determines permissions by analyzing a command's filesystem path and operational capabilities, rather than relying solely on the command name, thereby reducing misjudgments. It supports path-level fine-grained controls (read, write, delete, etc.), multiple policies (deny, one-time allow, etc.), and Seatbelt enforcement, while also restricting administrative tools and unauthorized binaries. The plugin enforces strict protection for configuration files and system paths, and mandates workspace isolation, effectively improving the sandbox security of DSH agents.