dsh-request-guard

Keeps a malformed provider response from wedging or poisoning a DeepSeek Harness session: fills empty tool-call ids on the write side, repairs the outbound message array (nameless calls, orphan/stranded results, missing results, bad arguments), and retrie