dsh-capsule: Provides Linux Sandbox Isolation for Third-Party DeepSeek Harness Plugins

dsh-capsule is a Bubblewrap-based security plugin designed to provide system-level isolation for DeepSeek Harness. It creates an independent Linux process to physically isolate third-party plugins from the host environment, preventing malicious code from compromising the system. The plugin supports integrity verification, tool registration, and per-invocation isolation, and allows restricted access to host files via the `workspace-read` permission. Currently, v0.1 primarily supports Linux systems and provides only file-read access, without network, write, or subprocess execution capabilities.