[Epic] Support DeepSeek Harness as a first-class NemoClaw agent runtime

## Summary

Make DeepSeek Harness a supported NemoClaw agent runtime alongside the current supported agents.

A user must be able to select DeepSeek Harness through canonical onboarding. NemoClaw must package, configure, operate, recover, qualify, and update one exact DeepSeek Harness runtime.

The supported path runs the complete harness inside a NemoClaw-managed sandbox. NemoClaw does not install or run the harness directly on the user host.

## Open-source product scope

This epic defines the public open-source NemoClaw product surface. It does not establish product approval by itself.

Gate 1 must record an accepted maintainer decision before implementation makes DeepSeek Harness a supported surface.

Changes to the upstream DeepSeek Harness repository and a separate external sandbox backend are outside this epic.

## Delivery target

The planning target is the `Roadmap: Q3 2026` milestone. Gate 1 must name the product owner, engineering owner, and release target.

## Context

The initial package candidate is `@deepseek-ai/dsh@0.1.0-rc.7`, npm integrity `sha512-ZceDCJ8FAywih+USW/OMk9jEhunlvJBGEz4kqrhau23hPzbciOazZrywH0nBRsaalSeAJ1JGBmjtw4OSjToStw==`, from source commit `99f6f02fecdb7dff40c3fbc9470f5907c29f74ca`.

DeepSeek Harness is prerelease software. Gate 1 may select a different exact package after dependency and compatibility review.

DeepSeek Harness has two relevant surfaces:

- `dsh web` starts a long-running browser application on a loopback address.
- `dsh --profile headless ""` creates one session, prints the final result, and exits.

DeepSeek Harness has no built-in terminal UI. Its Host and Origin checks restrict browser reachability but do not authenticate a user.

NemoClaw already has candidate selection, exact managed-image contracts, dual-architecture publication, shared lifecycle operations, state manifests, managed inference, and dashboard forwarding. The Pi candidate work is the implementation baseline. The Hermes dashboard is the nearest browser-surface sibling.

Issue #8892 assesses Relay and Switchyard contracts for other harnesses. It does not own this agent-runtime integration.

## Problem Statement

Users cannot select DeepSeek Harness through NemoClaw.

NemoClaw has no accepted contract for:

- the exact package and managed image;
- browser and headless startup;
- browser authentication or a loopback-only exposure limit;
- managed inference and model selection;
- credential custody;
- profiles, settings, tools, plugins, and permission behavior;
- persistent sessions, attachments, workspace, snapshot, restore, or recovery;
- network, filesystem, process, and telemetry policy;
- package upgrades and state compatibility;
- exact-candidate qualification and activation.

A manual package installation does not establish a supported NemoClaw agent runtime.

## Desired Behavior

After all gates pass, a user can select DeepSeek Harness through interactive onboarding or:

```bash
nemoclaw onboard --agent deepseek-harness
```

Stock onboarding selects an exact managed-image digest. It does not build a repository Dockerfile on the user host.

The accepted Web and headless surfaces use managed inference through `https://inference.local/v1`. The sandbox does not receive the upstream provider credential.

Supported lifecycle commands identify the agent as DeepSeek Harness. They preserve only the state accepted by Gate 1.

## Product Decision Required

Gate 1 must accept or amend these proposed v1 decisions:

- Canonical agent ID: `deepseek-harness`.
- Display name: `DeepSeek Harness`.
- Runtime binary: `/usr/local/bin/dsh`.
- Package source: one exact npm package, integrity value, lockfile, and managed-image digest.
- Launch matrix: Docker on `linux/amd64` and `linux/arm64`; Podman deferred.
- User surfaces: Web and headless, or headless-only when no accepted browser-authentication boundary exists.
- Browser boundary: an authenticated proxy prerequisite or an explicit loopback-only `auth: none` limit.
- Headless command: a generic gateway-with-headless dispatch contract or a documented existing command.
- Process model: shared or isolated `$DSH_HOME` values for concurrent Web and headless execution.
- Managed inference adapter, API family, model validation, and release qualification model.
- Final managed configuration authority that user and profile patches cannot override.
- Exact agent preset and tool roster.
- Inner DSH filesystem-sandbox behavior under the outer sandbox policy.
- External plugins, project profiles, skills, MCP, Web tools, package installation, telemetry, and feedback-export policy.
- Persistent, reconstructed, and prohibited state.
- Same-version rebuild and recovery behavior.
- Upgrade compatibility, requalification, failure, and rollback behavior.

The current `llm-pi-ai` adapter, `openai-completions`, and `nvidia/nemotron-3-super-120b-a12b` are starting candidates. They are not accepted contracts until Gate 1 records them.

## Minimal v1 Scope

- One agent manifest under `agents/deepseek-harness/`.
- One exact package closure and managed OCI image.
- Exact managed-image digests for each accepted architecture.
- Candidate-only registration with no accepted qualification receipt.
- The Web and headless surfaces accepted by Gate 1.
- Managed inference through `inference.local`.
- No upstream provider credential inside the sandbox.
- A deny-by-default agent policy.
- Declared state for restart, rebuild, snapshot, restore, recovery, and destroy.
- Deterministic tests and exact-candidate live E2E evidence.
- Public documentation and atomic activation after qualification.

## Constraints and Non-goals

- Do not install or run DeepSeek Harness directly on the host.
- Do not use a floating package version, image tag, runtime self-update, or first-boot package installation.
- Do not build the stock image from a Dockerfile during user onboarding.
- Do not expose an upstream provider credential to the sandbox.
- Do not claim browser authentication from Host or Origin checks.
- Do not assume Web and headless processes can share one `$DSH_HOME` safely.
- Do not let settings, home patches, or profile patches replace the managed inference and policy authority.
- Do not restore executable plugin or project trust from a snapshot.
- Do not promise arbitrary release-candidate state migration.
- Do not add a DeepSeek Harness-specific Docker, lifecycle, recovery, snapshot, or destroy branch.
- Do not refactor every agent integration as part of this epic.
- Do not make DeepSeek Harness publicly selectable before exact qualification evidence is accepted.

## Implementation Idea

Use the manifest-first agent architecture:

```text
agents/deepseek-harness/
manifest.yaml
start.sh
generate-config.ts
policy-additions.yaml
dependency-review.md
package.json
package-lock.json
Dockerfile
Dockerfile.base
```

Add DeepSeek Harness to candidate discovery, managed-image validation, startup-profile inputs, and candidate publication without adding it to the shipped image cohort.

Use one root-owned final configuration overlay for managed inference and required policy settings. Treat user profile patches as untrusted input.

Extend shared runtime dispatch only when Gate 1 requires a gateway agent with a supported headless command. Do not add a name comparison to shared lifecycle code.

## Acceptance Criteria

- [ ] Gate 1 records an accepted product decision and names product and engineering owners.
- [ ] One exact package closure and each managed image are integrity-verifiable.
- [ ] Stock onboarding selects exact image digests without a host build.
- [ ] Candidate selection remains disabled until an accepted qualification receipt exists.
- [ ] Users can reach only the Web and headless surfaces accepted by Gate 1.
- [ ] The accepted browser boundary denies access outside its stated authentication and reachability contract.
- [ ] Both accepted surfaces use managed inference through `inference.local`.
- [ ] No upstream provider credential enters the image, sandbox, registry, logs, snapshot, or evidence.
- [ ] User settings and profile patches cannot replace the managed inference or policy authority.
- [ ] The accepted tool, plugin, profile, browser, filesystem, process, network, and telemetry policies fail closed.
- [ ] Restart, rebuild, snapshot, restore, recovery, and destroy preserve only accepted state.
- [ ] Fresh `linux/amd64` and `linux/arm64` environments pass exact-candidate qualification.
- [ ] Evidence identifies the exact NemoClaw commit, package integrity, image digest, architecture, compute runtime, model, policy digest, task, and oracle result.
- [ ] One final activation change adds the agent to public selection and the complete shipped image cohort.

## Work Tracking

Delivery order: Gate 1 → Gate 2 → Gates 3–6 → Gate 7 → Gate 8.

- [ ] #9329 — Accept product scope, ownership, threat model, and compatibility matrix.
- [ ] #9330 — Produce a reproducible DeepSeek Harness candidate runtime.
- [ ] #9331 — Let users onboard and use the accepted Web and headless surfaces.
- [ ] #9332 — Preserve and recover accepted DeepSeek Harness state.
- [ ] #9333 — Run DeepSeek Harness through managed inference without provider credentials.
- [ ] #9334 — Enforce the accepted DeepSeek Harness trust and policy boundary.
- [ ] #9335 — Qualify the exact candidate on AMD64 and ARM64.
- [ ] #9336 — Activate the qualified runtime and publish supported operations.

## Category

Feature

## Checklist

- [x] I searched open and closed issues and found no duplicate.
- [x] I described the problem and desired behavior.