dsh-canary: DeepSeek Harness Plugin

`dsh-canary` is a security plugin for DeepSeek Harness (DSH) that detects and blocks specific planted markers echoed in tool calls or URLs. The plugin plants a unique canary string in the context, provides protection by intercepting calls containing that marker, and supports incident logging. Developers can implement interception logic using library APIs such as `plantCanary` and `wrapExecute`, or use functions such as `assertNoCanary` to enforce strict checks at entry points. This plugin depends on DSH RC `0.1.1-rc.2` and is intended to prevent sensitive context from leaking during tool execution.