dsh-safe-workflow: Adding a controlled and verifiable workflow for DSH

dsh-safe-workflow is a DeepSeek Harness (DSH) plugin designed to make the coding workflow more controlled and verifiable by introducing policy checks, approval gates, and evidence recording. It does not replace the sandbox; instead, it checks path rules and requests approval before the model calls a tool, while also recording task contracts, checkpoints, and verification results. The plugin exposes the `safe_workflow` tool, supporting operations such as starting, querying status, taking snapshots, restoring, verifying, and closing contracts. It stores data in the `.dsh-safe-workflow/` directory within the session workspace. Installation requires checking out the local DSH source code and using the `pnpm dsh plugin` command to specify the plugin directory for addition. Typical usage includes defining task objectives, acceptance commands, modifiable paths, and items requiring approval.