Native RoleHub bridge for DeepSeek Harness

Key features

• A catalog label is discovery metadata, not a cryptographic signature.
• Choose a portable agent role.
• DeepSeek Harness support is a developer-preview integration pinned to 0.1.0-rc.6
• Before activation, the bridge checks the complete catalog identity against the loaded manifest, records the downloaded archive hash, and verifies the manifest, bundle lock, and final RoleHub bundle digest.
• Reference publishers must be explicitly trusted by that exact Hub configuration