dsh-code-runtime-container: Container-Isolated Code Execution Backend

`dsh-code-runtime-container` is a container isolation backend plugin for DeepSeek Harness, designed to address the insufficient isolation of the native worker-thread backend. It executes code via Docker/Podman and provides strict network, file system, resource, and permission restrictions. Users must configure the container image and be mindful of the security boundaries: this plugin does not protect the host kernel or the Docker socket, and it isolates code execution itself only, without restricting tool calls. It is suitable for running untrusted code in Code Mode.