Add DeepSeek Harness

[Jacob953]

Change

Closes #1.

Move the DeepSeek Harness integration developed in kagent-dev/kagent#3195 into harnesses/deepseek/ as an independent community experiment maintained by @Jacob953.

• Connect DSH through ACP and the existing BYO/A2A contract, with persistent conversations and workspaces.
• Support HTTP MCP tools, protected-tool approvals, DATA-restored public tasks, settled conversation forks, and Linux process cleanup.
• Include an optional standalone PostgreSQL-backed approval service, deployment examples, tests and source attribution.
• Explicitly disable session-log and plugin-inventory uploads while retaining local persistence; cover the existing completion barrier with delayed/failed session/close regression tests.

Targets DSH 0.2.0-rc.2 and kagent 0a57368aca33, including the merged restoration contract from #3165. No shared kagent runtime/controller or DSH source changes are included.

Incremental output and per-call model usage reporting remain unsupported. Native ACP permissions still require a live process. Pending tasks cannot be checkpointed, uncertain remote outcomes are not automatically replayed, and shared recovery limits in #3010 remain. Supported configuration and conditions for adopting other upstream fixes are documented in the README.

Build

Passed from a clean source export, with the harness directory as the entire context and no credentials or build arguments:

docker build --platform linux/amd64 --tag byo-ext/deepseek:pr harnesses/deepseek

The October 17 follow-up rebuilt the AMD64 image from a clean source export and passed non-root startup checks. The ARM64 production build passed during October 16 migration acceptance.

Manual verification

• October 17 full Linux arm64 race suite: 49 top-level tests, 141 passing test/subtest entries; no failures, skips or race reports. Includes delayed/failed persistence completion and real-DSH request checks across conversation recovery.
• October 16 Linux arm64 race suite: 48 top-level tests, 138 passing test/subtest entries; no failures, skips or race reports.
• October 16 independent Kind cluster: all 15 scenarios passed, covering conversation/workspace continuity, MCP approvals, Worker replacement after a DATA snapshot, and fork behavior. A settled fork completed a new approval while the source conversation remained usable.
• Host short race tests and host/Linux lint passed.

Cluster tests used real DSH, PostgreSQL and Substrate with local model/MCP fixtures. The October 17 follow-up did not repeat cluster acceptance. No live provider calls or full AMD64 runtime regression were performed. Commands, versions and coverage boundaries are recorded in VERIFICATION.md.

Checklist

• My commits include DCO sign-offs (git commit -s).
• I followed the Code of Conduct, including its guidance on AI assistance.
• I updated the relevant documentation and, for a new harness, the catalog.
• I included no credentials or private configuration.

AI assistance was used for implementation, testing, documentation and this description.