Give DeepSeek Harness agents native image reading

Key features

• Not yet verifieda real end-to-end read against a live vision endpoint.
• Inputs resolve against the workspace and allowedDirs through realpath, so a symlink cannot escape the fence.
• The request/response logic is covered by a mocked-fetch unit test, but the plugin has not been smoke-tested inside a running dsh profile against a real multimodal model.
• Do that once with a real VISION_API_KEY before relying on it.
• Images are size-limited and extension-checked before upload.