Address the three ds-review-bot warnings on #253:
- An empty DSH_CORDIS_CONFIG now counts as absent when deciding whether
to inject the bundled default config, matching the runtime bin's
config-discovery semantics.
- The injection moves from DeepSeekHarness into HarnessClient.start(),
so the low-level client's default bundled launch also boots without
callers duplicating the env setup.
- The bare single-file exe artifact ships inside a tar.gz like the
Python bundle: upload-artifact's zip transport drops the executable
bit.
Yichen Jiang