dsh-attestation-proof: Offline Deterministic Release Proof for DeepSeek Harness

dsh-attestation-proof is a plugin for DeepSeek Harness (DSH) used to generate offline, deterministic release attestations. By verifying the consistency of a manifest with local identities and pinned keys, the plugin fills a gap in supply chain security verification. Its core features include offline verification, support for DSSE/in-toto statements, secure report generation, and strict filesystem restrictions. It provides two commands, inspect and verify, and outputs only JSON verdicts containing content without sensitive information, making it suitable for security audits and build quarantine scenarios in air-gapped environments.