RunSeal 沙箱插件:为 dsh 提供 OS 原生策略执行边界(Windows/macOS/Linux) | RunSeal sandbox provider for DeepSeek Harness — OS-native policy-enforced command execution