dsh-trust-check: Static Capability Disclosure of the DeepSeek Harness Plugin

`dsh-trust-check` is a static plugin audit tool for DeepSeek Harness (DSH). It analyzes plugin source code to statically disclose capability surfaces (e.g., read/write, network), injection surfaces, and provenance surfaces, providing file line numbers and source excerpts as evidence, without consuming tokens and without issuing a “secure” conclusion. The tool supports both Web UI and CLI modes (including CI gates) and returns three verdicts: Red, Requires Confirmation, and No Risk. Core features include detecting high-confidence risks such as installation scripts, core bundle overwrites, credential reads, and plaintext HTTP connections outside the internal network. The plugin exports a stable API for integrators to quickly screen plugins before installation.