dsh-safe-updater: Protected Automatic Updates for DeepSeek Harness

dsh-safe-updater is a plugin maintained by lucifer726, intended to resolve configuration errors or interruptions that can easily occur during DeepSeek Harness (DSH) upgrades. It ensures a rollback-capable upgrade process through isolated environment validation, configuration verification, and health checks. The plugin offers three modes: `notify` (check only), `stage` (staged dry-run installation), and `apply` (automatic switch). It supports manual or Supervisor-driven controlled upgrades, with security features such as command injection prevention, data isolation, and recursion prevention. It requires Node.js 22 or later and specific peer dependencies.