dsh-safety-net: Adding self-protection guardrails to DeepSeek Harness

dsh-safety-net is a self-protection plugin for DeepSeek Harness (DSH), designed to prevent agents from mistakenly modifying critical files that could lead to system crashes. Its core capabilities include hard-intercepting write or edit operations on protected paths, automatically backing up the original file to a specified directory prior to modification, and providing a suite of CLI self-recovery commands. By default, the plugin enables strict mode, declares a read-only sandbox policy, and issues alerts when the host sandbox configuration is deemed too loose. Users can install the plugin using `dsh plugin add`, which requires Node.js ≥ 20 and depends on specific libraries provided by the DSH host runtime. Typical usage includes checking status, manual backup, restoring specific backups, fixing missing files, and granting one-time write permissions. Built-in protected paths cannot be removed via configuration, while additional paths are only supported at runtime.