dsh-provenance: Provenance verification before DeepSeek Harness plugin installation

dsh-provenance is a DSH plugin developed by Darren Tang, designed to address supply chain security risks during agent plugin installation. By checking the consistency between the pending installation package and the read source code before code execution, it identifies potential issues in advance and provides judgments of "ok," "review," or "block." The tool supports checking source provenance, registry integrity, install hooks, SLSA build provenance, and artifact-to-source comparison. It offers two usage methods: CLI and DSH tool, supports CI integration, and features installation interception to prevent un-audited plugins from being installed. It is worth noting that dsh-provenance focuses on source verification, does not execute audited packages, does not verify Sigstore signatures, and does not perform code behavior scanning or runtime monitoring. Its clean report...