v0.8.0: WebUI redesign, /web, workspace switch, 75% budget, no shell timeout

The front end is rebuilt on the design tokens the desktop app ships (surfaces,
color-mix borders, alpha hovers, accent): a 30-icon inline SVG sprite, dark and
light themes, layout switches as deep links (?side=0, ?panel=0, ?theme=light)
resolved before the first paint. The empty page is one line and leaves with the
first turn; the right rail keeps three cards - todo, file changes (+N -M) and
context (tokens, prompt cache hit rate). Both rails animate in and out, and a
collapsed rail widens its grid track to 0 instead of being removed, so the
transcript never slides into a zero-width column.

- src/webui.c: POST /api/workspace - re-root the agent at another directory
  (permission rules, metrics, AGENTS.md follow) and start a session there, as
  sessions live per directory; state also reports cached/cache_miss tokens
- src/agent_loop.c: cst_agent_set_workspace(), rebuilt prompt and re-measured
  budget; the auto-compact threshold is 75% of the window (was 60%)
- src/tui.c: /web forks a WebUI next to the TUI - separate process and a new
  session, because cst_webui_run() blocks and two writers corrupt one session
- src/os_compat.c, src/os_win.c: run_shell runs without a time limit unless
  CST_SHELL_TIMEOUT asks for one, so builds and long clones finish
- src/main.c, include/cst_webui.h: one CST_WEBUI_DEFAULT_PORT for --help, the
  docs and /web; Termux opens the browser through termux-open-url
- README.md, docs/webui.md, docs/env_openai.md: /web, /api/workspace, the new
  state fields, the 75% threshold and the layout deep links

tests/e2e_webui.sh green (permission round-trip, token paths, --web-dev);
make check green.

src/main.c

@@ -43,7 +43,7 @@ static void usage(const char *argv0) {
           "  -n, --max-steps N     model calls per turn (30)\n"
           "  -H, --headless -p TEXT  run one prompt without the TUI\n"
           "      --web             serve the UI over HTTP on 127.0.0.1:8787\n"
-          "      --web-port N      port (0 = pick a free one)\n"
+          "      --web-port N      port (default 8787, 0 = pick a free one)\n"
           "      --web-host ADDR   bind address (default 127.0.0.1; a\n"
           "                        non-loopback address requires a token)\n"
           "      --web-token T     require ?token=T / Authorization: Bearer T\n"
@@ -332,6 +332,7 @@ int main(int argc, char **argv) {
   int web_mode = 0;
   cst_webui_opts_t web;
   memset(&web, 0, sizeof(web));
+  web.port = CST_WEBUI_DEFAULT_PORT; /* 0 would mean "pick a free one" */
   const char *env = getenv("CST_WEB_PORT");
   if (env && env[0])
     web.port = atoi(env);