dsh-approval-first: DeepSeek Harness Approval-First Editing Plugin

`dsh-approval-first` is a DeepSeek Harness plugin designed to optimize security controls in sandbox environments. It leverages a “shadow tool” mechanism to display an approval card with code diffs directly to the user when a model attempts a write operation that is rejected by policy, avoiding repeated tool calls by the model. The plugin supports silent and popup modes, and includes features such as “read-first” gating, a drift sensor, and session mode switching. It focuses the review target on diffs rather than textual descriptions, reducing ineffective retries. Currently, the plugin is a transitional stub and affects only the `edit` and `write` tools.