dsh-workspace-only-plugin: Add Workspace Only file access switch for DSH

`dsh-workspace-only-plugin` is an MIT-licensed plugin for DeepSeek Harness (DSH) designed to centralize file access outside the workspace to user confirmation under any sandbox mode. This plugin captures out-of-bounds paths and embedded absolute paths within tool calls such as `read`, `write`, `edit`, and `bash` via lexical scanning. Once files outside the working directory are detected, it dispatches an `approval/request` request. If approved by the user, the call proceeds; otherwise, it is blocked. This mechanism can even override the `danger-full-access` mode, ensuring that a forced modal is displayed even if the approval policy is set to `never`. The plugin supports a global persistent switch and integrates with `dsh-auto-mo...`