feat: add project-composable DeepSeek Harness microVMs

Share the live project cwd, DSH home and skills read-write while running guest root behind rootless QEMU and Bubblewrap. Reuse project toolchains, expose configurable SSH-forwarded web access, and launch the latest official DSH.

Include the project template, operating guide, offline boot and mount tests, and shell checks.

README.md

@@ -24,6 +24,7 @@ Flat, explicit NixOS modules with locked inputs. Required setup belongs here—n
 | `desktop-test.nix`, `desktop-test.py`, `audit-desktop.sh` | Disposable graphical/PAM/audio/scaling audit |
 | `workstation.nix`, `nvidia.nix` | Shared local hardware/SDDM integration for laptop and VM; separate opt-in NVIDIA support |
 | [DESKTOP.md](DESKTOP.md) | Live audit, wallpaper provenance, JaKooLit comparison and explicit feature-completion plan |
+| `agent-vm/`, `templates/agent/`, [AGENT-VM.md](AGENT-VM.md) | Reusable rootless DSH microVM, shared project toolchain, live RW cwd/config/credentials/skills and access/networking guide |
 
 ## Account and session
 
@@ -90,6 +91,14 @@ See [DESKTOP.md](DESKTOP.md) for the screenshot-led audit, functional coverage,
 
 These are system-owned executables from Nix, not unmanaged `npm -g`, `pip install --user` or `cargo install` bootstraps. Project dependencies may still be downloaded by their ordinary package managers. `nix develop` / `.envrc` remain appropriate for project-specific versions; this is not a promise that every language project uses the same global toolchain.
 
+### Per-project DeepSeek Harness
+
+[AGENT-VM.md](AGENT-VM.md) documents the project template and `nix run .#agent`.
+The official `dsh@latest` runs as root in a rootless microVM, with the current
+project and your standard DSH home/shared skills mounted **read-write**. Its
+host Web listener defaults to localhost; RAM, vCPUs, IPs and optional TAP
+networking are configured through Nix modules. No host service is activated.
+
 ### Local Tor client
 
 On both hosts, `network.nix` installs Tor from the **system pin** and enables `tor.service` at boot. It runs as the dedicated `tor` user with the NixOS module's sandbox and private persistent state in `/var/lib/tor`. Systemd restarts an exited daemon after five seconds without a retry limit; an explicit `systemctl stop tor` still stops it normally. A running process does not guarantee network connectivity—check for `Bootstrapped 100%` in the journal.