feat: add DeepSeekHarnessAgent: DeepSeek Harness CLI runtime

[now-ing]

Summary

• Adds DeepSeekHarnessAgent, a fourth built-in Agent implementation backed by the non-interactive dsh --profile headless "<task>" command from DeepSeek Harness, alongside the existing CodexAgent, ClaudeAgent, and PiAgent.
• AgentOptions.sandbox maps one-to-one onto the DSH_PERMISSION_MODE environment variable — read-only, workspace-write, and danger-full-access share the shared policy names verbatim. When sandbox is omitted, the variable is left untouched and DeepSeek Harness applies its own workspace-write default.
• The headless surface has no stdin prompt channel, so the task travels as a command-line argument; processes are still spawned with argument arrays, never through a shell.
• AgentOptions.schema is embedded as a structured-output contract in the task (the headless app has no schema flag); the adapter parses the JSON object from the final assistant message, tolerating surrounding prose or Markdown fences.
• The model cannot be overridden per run (no headless model flag; DeepSeek Harness resolves it from the agent-default-model setting in $DSH_HOME/settings.yaml), so AgentOptions.model and AgentOptions.additionalWritableDirectories throw a TypeError instead of being silently ignored. Session records persist under $DSH_HOME for audit; there is no ephemeral switch to fake.
• CLI integration mirrors the Pi PR: --agent dsh selects the runtime for deer-workflow create; usage/help strings, bilingual README + docs/api + docs/index + AGENTS.md, and the workflow-creator skill reference are updated. CodexAgent remains the default agent() export — purely additive and opt-in.

Test plan

• bun run typecheck
• bun run lint
• bun run format:check
• bun test (100 pass, including 10 new DeepSeekHarnessAgent tests using a stub CLI and one new create --agent dsh integration test)
• Manually smoke-tested DeepSeekHarnessAgent against a real DeepSeek Harness CLI (0.1.0-rc.6, repo-built launcher via commandArgs):
  • text run returns the exact final message (deer-workflow-dsh-e2e-ok);
  • sandbox: "read-only" is honored (the harness runtime context reports Current DSH file policy: read-only);
  • schema-backed run embeds the JSON Schema contract in the task and returns the parsed object ({"answer":"workspace inspected under read-only policy","ok":true}) extracted from a prose-wrapped fenced-JSON final message.