secret-redaction

Runtime tool policy, dangerous-command guard, and output redaction for DeepSeek Harness.

Runtime security gate for DeepSeek Harness: egress host allowlist, secret redaction in tool results, and an append-only audit log