workspace-write 3

Fix and diagnose DeepSeek Harness on native Windows. Official PowerShell, Workspace Write, shortcuts, and legacy preset repair. No WSL.

Pre-dispatch guard for dsh writes whose path leaves the granted write area through a link. Every write confinement in the harness canonicalizes first and then refuses, which is the right enforcement answer and a poor diagnostic one: `<workspace>/link/out.

DSH plugin: automatic approval for configured directories and commands — stop the sandbox-escalation popups you already trust, keep the rest. · DSH 自动权限审批插件：按允许目录与「以某命令开头」的允许命令自动放行工作区写模式下的越权审批弹窗，并在审批卡片上提供「始终允许」按钮。