dsh-security-assurance: DeepSeek Harness Policy-Driven Repository Security Assessment Plugin

`dsh-security-assurance` is a policy-driven repository security assessment plugin for DeepSeek Harness. It integrates with the Harness API and encapsulates the assessment process into queryable, auditable, versioned results, aiming to address the difficulty of tracing the provenance of static scanning results. The plugin primarily provides Node.js project lifecycle checks, npm publishing surface checks, pnpm lockfile integrity validation, GitHub Actions permission checks, and normalization and independent verification of reports such as Gitleaks. It supports three assessment modes—REPOSITORY, CHANGE, and TARGETED—and relies on a Node.js environment. As a security assurance tool, the plugin focuses on evidence collection and independent verification rather than general-purpose scanning. It only supports