feat: make DSH monitoring easy to install and route

[MicroMilo]

What changed

Upstream Radar is the always-on dependency radar for DeepSeek Harness (DSH) plugins. This PR keeps the DSH-native path first and makes both first use and continuous vulnerability monitoring easier to trust:

• Monitor the exact installed plugin graph, including the DSH executable host-runtime dependency closure.
• Query exact transitive vulnerability paths and npm release signals, then route durable, project-specific follow-up tasks to the matching DSH Agent.
• Add an independent GitHub Advisory Database source for exact npm versions, with optional environment-only GITHUB_TOKEN support.
• Merge OSV and GitHub Advisory reports through GHSA/CVE aliases into one durable incident, retaining source metadata and fix versions.
• Preserve advisory provenance through state, terminal output, status/history, Job Summary, and webhook payloads, so an OSV-only hit is distinguishable from an OSV + GitHub cross-confirmed hit.
• Surface severity and fixed-version disagreements as explicit source conflicts instead of silently making operators infer why multiple fixes are listed.
• Preserve confirmed findings, evidence, and incident identity when one advisory source is unavailable; create a source-health incident only after three consecutive failures.
• Retry one bounded transient GitHub transport, rate-limit, or 5xx failure so a temporary network hiccup does not block the first real DSH check; permanent errors remain visible.
• Add a read-only quickstart command that detects an existing config, one lockfile, or eligible DSH profiles and prints one copy/paste path with explicit side-effect labels. It refuses to guess between multiple profiles or lockfiles.
• Pass the GitHub job token to the reusable Action so CI checks are less likely to hit anonymous API limits.
• Add a network-free GitHub Advisory showcase and keep the DSH host-runtime, Action, Job Summary, Feishu/webhook, status/history, and quickstart surfaces covered by release checks.

Why

The DSH path needs continuous evidence, not a one-time scan. Two advisory sources can describe the same issue differently, and a temporary feed outage must not look like a clean result. This slice makes those states deterministic: deduplicate by known GHSA/CVE identity, retain the last confirmed finding during partial coverage, preserve the source list that confirmed the finding, make disagreements visible, and route the source outage itself to DSH after three failures. The showcase proves the behavior without contacting a real feed.

The quickstart command still never installs packages, starts DSH, queries vulnerability sources, or executes plugin code. The GitHub Advisory client only reads exact npm coordinates, bounds response size and pagination, rejects insecure endpoints, retries only transient failures once, and never persists the token.

Validation

• pnpm run check
• pnpm test — 214 tests
• pnpm run showcase:github-advisories — two reports become one incident with osv + github-advisories provenance and explicit severity/fixed-version conflicts; outage retains evidence and identity; recovery resolves only source health
• pnpm run showcase:dsh-adoption — real DSH 0.1.0-rc.6 plus dsh-cloudflare-browser-run@0.1.1; 516 dependency nodes, 512 packages queried, 189 release streams, no source errors, healthy/complete status
• pnpm run showcase:quickstart
• pnpm run showcase:dsh-host-alert
• pnpm run showcase:dsh-runtime:report
• pnpm run showcase:dsh-adoption:report
• pnpm run release:check
• GitHub Actions Node 22/24 matrix

This remains a draft. Do not merge or publish npm from this task.