redaction

Fail-closed export-copy redaction for DeepSeek Harness session telemetry

DSH / DeepSeek Harness plugin: runtime secret & PII redaction with mask, reversible vault and execution-time substitution