feat: AcFun tools plugin for DeepSeek Harness

Eight tools (search, video, comments, danmaku, rank, playurl, interact,
post_comment) over acfun.cn's public web API, a model-facing skill, a
bundle patch with a skill-filesystem row, and offline/live checks.

Reads are anonymous; writes require allowWriteActions plus a login cookie.

cordis.patch.yml

@@ -0,0 +1,27 @@
+# dsh-plugin-acfun bundle patch — one insert row over the profile tree.
+# Override any field in the profile's cordis.patch.yml — later layers win per row.
+- insert:
+    - id: acfun
+      name: 'dsh-plugin-acfun'
+      config:
+        # Optional: AcFun login cookie string (see README.zh.md). Leave empty for
+        # anonymous reads. Prefer the environment variable over inlining a secret.
+        cookie: ''
+        # Environment variable read when `cookie` is empty.
+        cookieEnv: ACFUN_COOKIE
+        # Interactions (like / coin / favorite / follow / comment) stay off until
+        # this is explicitly true. Reads never require it.
+        allowWriteActions: false
+        # Per-request timeout (ms).
+        requestTimeoutMs: 30000
+        # Cooperative per-call tool budget (ms). Write calls use at least 60s.
+        timeoutMs: 45000
+    # Second row: expose this bundle's model-facing Skill (skills/) to the Agent.
+    # The packaged Skill root is resolved from the installed npm identity anchored
+    # at the profile (Loader baseUrl), never concatenated onto baseUrl.
+    - id: acfun-skill-filesystem
+      name: '@deepseek-ai/dsh-skill-filesystem'
+      config:
+        providerName: acfun-plugin
+        includeDefaultRoots: false
+        bundledSkillDir: !!js process.getBuiltinModule('node:path').join(process.getBuiltinModule('node:path').dirname(process.getBuiltinModule('node:module').createRequire(baseUrl).resolve('dsh-plugin-acfun/package.json')), 'skills')