Bump dsh to 0.2.1-alpha.1-r1

[max06]

Bumps the DeepSeek Harness community chart (git ref) and image tag in lockstep from 0.1.5-rc.2-r1 to 0.2.1-alpha.1-r1.

• Chart templates/default values unchanged between the two tags; rendered StatefulSet keeps our args (--trusted-host), NetworkPolicy, workspace PVC.
• Adds a header note: the tool sandbox relies on Landlock being in the node's active LSM list; the bubblewrap variant is Docker-Compose-only upstream (No usable sandbox backend on kernels without Landlock: bwrap is absent from the image, so the bash tool never runs runzhliu/deepseek-harness-docker#35).

Post-sync: update the DeepSeek endpoint to https://api.deepseek.com/anthropic (Messages API is now the only protocol) and verify sandbox confinement with a real tool call.

🤖 Generated with Claude Code

[github-actions]

ATLAS Review

Changes detected in 3 resource(s) across 1 release(s).
Please review before merging.

Affected releases

cyrannus/picon / dsh / dsh (3 resources)

NetworkPolicy/dsh (10 lines)

@@ metadata.labels.helm.sh/chart @@
! ± value change
- deepseek-harness-0.1.9
+ deepseek-harness-0.1.19

@@ metadata.labels.app.kubernetes.io/version @@
! ± value change
- 0.1.5-rc.2
+ 0.2.1-alpha.1

Service/dsh (10 lines)

@@ metadata.labels.helm.sh/chart @@
! ± value change
- deepseek-harness-0.1.9
+ deepseek-harness-0.1.19

@@ metadata.labels.app.kubernetes.io/version @@
! ± value change
- 0.1.5-rc.2
+ 0.2.1-alpha.1

StatefulSet/dsh (15 lines)

@@ metadata.labels.helm.sh/chart @@
! ± value change
- deepseek-harness-0.1.9
+ deepseek-harness-0.1.19

@@ metadata.labels.app.kubernetes.io/version @@
! ± value change
- 0.1.5-rc.2
+ 0.2.1-alpha.1

@@ spec.template.spec.containers.deepseek-harness.image @@
! ± value change
- ghcr.io/runzhliu/deepseek-harness:0.1.5-rc.2-r1
+ ghcr.io/runzhliu/deepseek-harness:0.2.1-alpha.1-r1

---

Generated by ATLAS Review — Re-run