feat: add project-composable DeepSeek Harness microVMs

Share the live project cwd, DSH home and skills read-write while running guest root behind rootless QEMU and Bubblewrap. Reuse project toolchains, expose configurable SSH-forwarded web access, and launch the latest official DSH.

Include the project template, operating guide, offline boot and mount tests, and shell checks.

templates/agent/project.nix

@@ -0,0 +1,18 @@
+{ pkgs }:
+{
+  # Single source of truth: both pkgs.mkShell and the VM consume this attrset.
+  # Replace/add your project's pinned toolchain here, not in two separate lists.
+  packages = with pkgs; [
+    python3
+    uv
+    ruff
+    nodejs
+    pnpm
+    git
+    ripgrep
+  ];
+  # Shared non-secret variables. Do not put API tokens in a Nix expression.
+  env = {
+    UV_PYTHON_DOWNLOADS = "never";
+  };
+}