dsh-secret-scrub: DeepSeek Harness Plugin

`dsh-secret-scrub` is a security plugin for DeepSeek Harness (DSH) that masks sensitive information during tool execution. It replaces keys with placeholders in input and output parameters based on predefined regular expression patterns (e.g., GitHub PATs, AWS keys), and records events to a log file, but never stores raw plaintext or provides reverse mappings. It depends on `@deepseek-ai/dsh-tools` ^0.1.1-rc.2, is not a manager, does not support real-time scanning, and only acts as a side-channel logger.