dsh-approval-guardian: Integrate one-time reviewer for DSH sandbox upgrade approvals

dsh-approval-guardian is a plugin bundle for DeepSeek Harness (DSH), designed to address interactive approval breakpoints in automated processes. It specifically intercepts strict sandbox escalation requests associated with the current tool execution and routes them to a one-off approval-reviewer agent, which determines the approval outcome based on structured allow or deny decisions. Following the "everything is a plugin" philosophy, the plugin handles only sandbox expansion requests; non-strict or irrelevant requests are delegated to the downstream answerer, preserving the original behavior of DSH. This plugin supports fail-closed and fallback-t...