dsh-write-protect: Read-Only Protection for Workspace Paths

The DeepSeek Harness (DSH) plugin `dsh-write-protect` addresses the limitation of the original sandbox, which only supported “all write” or “all read” modes, by allowing developers to apply read-only protection to specific paths (such as `.git`) in `workspace-write` mode. Maintained by azazo1, the plugin supports configuration-based interception of tool writes and command sandbox access, and provides session-level temporary authorization. It also supports placing `.readonly` rule files and configuring additional writable root directories. Note that the plugin requires a DSH engine version of 0.2.0-rc.1 or higher and has compatibility issues on Windows.