Add DeepSeek Harness Parallel Search plugin

[georgeatparallel]

Summary

• add @parallel-web/dsh-web-search-parallel as a first-class workspace package
• register Parallel Search as the native DeepSeek Harness web_search provider through cordis.patch.yml
• add deterministic provider, redirect-isolation, manifest, package-content, and profile-lifecycle checks
• add a Node 22.19/24/26 DSH compatibility matrix
• harden the generic release detector so new or metadata-only packages cannot publish and manual recovery only runs from main
• document installation, verification, contribution, security, and one-time npm bootstrap procedures

Why

DeepSeek Harness supports provider-neutral web search, but it does not include a Parallel provider. This package lets Harness users route the existing built-in web_search tool through Parallel without adding a second model-facing tool or expanding the package into fetch/extract behavior.

User impact

After the release candidate is published, users can install the plugin into the Harness web profile, export PARALLEL_API_KEY, and keep using the normal Harness web_search experience. The README includes a start-to-finish setup path and direct request-verification guidance.

Validation

• frozen workspace install
• whole-workspace lint, format check, typecheck, tests, and build
• 48 credentialless plugin tests
• one credentialed live Parallel Search request returning three citeable sources
• packed-artifact allowlist and disposable DSH add/activate/remove lifecycle
• 12 release-detection tests, including new-package, metadata-only, private-package, tag, invalid-ref, and version-change cases
• actionlint v1.7.7 on both workflows
• staged-diff disclosure and secret review
• production audit path review: no advisory path traverses the new package

Release follow-up

Merging this PR intentionally does not publish the newly added package. An npm organization owner must manually bootstrap 0.1.0-rc.0 under the rc dist-tag, configure npm trusted publishing for this repository and workflow, and then use the normal version-bump PR flow for later releases.

[georgeatparallel]

Superseded by #40, which uses a branch directly in parallel-web/parallel-npm-packages.