feat: DeepSeek Harness (dsh) agent support — skills, MCP scan + native toggle, audit

[RealZST]

Adds DeepSeek Harness (dsh) as the 12th supported agent.

What's included

Detection & config

• Detects dsh via $DSH_HOME/~/.dsh profile signals (strong signal: profiles/*/package.json with dsh.profile.bundles); project signal: .dsh/skills/
• Context files: ~/.dsh/AGENTS.md + project AGENTS.md/CLAUDE.md chain

Skills

• Scans all 4 skill roots (~/.dsh/skills, shared ~/.agents/skills, project .dsh/skills / .agents/skills), non-recursive per dsh semantics, .system subdir skipped
• Enable/disable via SKILL.md ⇄ SKILL.md.disabled rename (picked up live by dsh's file watcher)
• Cross-agent skill install targets .dsh/skills; install validation rejects camelCase invocation keys (see audit rule below)

MCP

• New McpFormat::DshCordis: parses @deepseek-ai/dsh-mcp-client rows from the home-layer cordis.patch.yml, tolerating the cordis YAML dialect (!!js expression tags are preserved, never evaluated)
• Native enable/disable through an HK-managed marker block appended to the patch file — dsh's official id-targeted disabled override mechanism. Text-level only: user bytes are never re-serialized; removing the block restores the file byte-for-byte. Unbalanced markers fail hard (ConfigCorrupted) instead of silently dropping user content
• Install/remove is intentionally not supported yet (loud Validation error); the managed-block insert writer is the headline of the follow-up PR together with plugin scanning

Audit

• New rule skill-invocation-key-case (Medium): flags camelCase invocation keys (disableModelInvocation / modelInvocable / userInvocable) that dsh rejects fail-closed — the whole skill is silently dropped. Per-key kebab-case suggestions (including the inverted-meaning modelInvocable case) with file:line locations
• Finding is also surfaced as a warning in the skill's detail panel (derived from the audit store; disappears once fixed and re-audited)

Frontend

• dsh registered in agent order/display names, whale mascot (reduced-motion safe), brand-adjacent oklch color tokens, onboarding records
• Audit rule registered in the frontend rule registry + i18n (en / zh / zh-TW)
• MCP detail panel note bridging dsh's UI naming (servers appear in dsh Settings → Plugins as mcp-client plugin cards)

Hardening beyond the plan (all pinned by tests)

• disabled: null ≡ false (matches upstream entry semantics)
• Native-toggle dispatch: hermes is now an explicit branch; a future native-toggle agent without a dispatch branch fails loudly instead of silently writing another agent's format
• Remote-vs-stdio decided by url presence first (a url row with an omitted/unknown transport can't produce a contradictory empty-command stdio entry)

Verification

• cargo test --workspace: 642 passed, 0 failed, no warnings
• tsc: 0 errors; vitest: 286/286
• Real-machine smoke against @deepseek-ai/dsh@0.1.0-rc.6: detect / skill scan (incl. shared ~/.agents attribution) / MCP scan all correct; hk disable → dsh's own --dump-config assembles disabled: true (official loader consuming HK's write); hk enable → byte-identical restore (MD5 verified); audit rule fires with per-key suggestions; toggles hot-reload live in dsh's own web UI

Known limitations (follow-up PR)

• The MCP install dialog still lists dsh as a target; submitting fails with a clear error. Deliberately not gated here — the next PR either makes install work (managed-block insert writer) or grays it out
• dsh plugin ecosystem (cordis rows) is not yet modeled; plugin scan/reconciliation is the next PR's main course
• Presets, hooks-bridge display, and precise cordis row-id display are tracked as P1

🤖 Generated with Claude Code