dsh-secret-paste: Replace keys pasted into DSH composer with [secret:REF]

`dsh-secret-paste` is an MIT-licensed plugin for the DeepSeek Harness Web profile, designed to prevent sensitive strings such as keys and tokens from appearing in plaintext in model messages and session history. The plugin detects keys pasted in the Composer using `@sanity-labs/secret-scan`, stores their values in the `~/.dsh/.credentials.yaml` file with 0600 permissions, and replaces them in drafts with `[secret:REF]` placeholders. If the model requires the real value, it can only resolve it on-demand using the dedicated tool `secret_resolve`, supporting recursive resolution for nested placeholders. For medium-confidence hits or when the detector is unable to...