dsh-secret-guard: Sensitive Payload Protection in DeepSeek Harness Tool Calls

`dsh-secret-guard` is a security guard plugin for DeepSeek Harness (DSH) designed to intercept sensitive payloads (such as API keys) in tool call parameters. The plugin validates parameters during the `tools/pre-execute` stage using heuristic detection, size limits, and a fail-closed policy. It supports configuring a list of protected tools and actions (block or ask) to prevent sensitive information from being leaked or misused. Developers can add the plugin via configuration files to perform secondary validation for sensitive model operations.