v0.8.0: WebUI redesign, /web, workspace switch, 75% budget, no shell timeout

The front end is rebuilt on the design tokens the desktop app ships (surfaces,
color-mix borders, alpha hovers, accent): a 30-icon inline SVG sprite, dark and
light themes, layout switches as deep links (?side=0, ?panel=0, ?theme=light)
resolved before the first paint. The empty page is one line and leaves with the
first turn; the right rail keeps three cards - todo, file changes (+N -M) and
context (tokens, prompt cache hit rate). Both rails animate in and out, and a
collapsed rail widens its grid track to 0 instead of being removed, so the
transcript never slides into a zero-width column.

- src/webui.c: POST /api/workspace - re-root the agent at another directory
  (permission rules, metrics, AGENTS.md follow) and start a session there, as
  sessions live per directory; state also reports cached/cache_miss tokens
- src/agent_loop.c: cst_agent_set_workspace(), rebuilt prompt and re-measured
  budget; the auto-compact threshold is 75% of the window (was 60%)
- src/tui.c: /web forks a WebUI next to the TUI - separate process and a new
  session, because cst_webui_run() blocks and two writers corrupt one session
- src/os_compat.c, src/os_win.c: run_shell runs without a time limit unless
  CST_SHELL_TIMEOUT asks for one, so builds and long clones finish
- src/main.c, include/cst_webui.h: one CST_WEBUI_DEFAULT_PORT for --help, the
  docs and /web; Termux opens the browser through termux-open-url
- README.md, docs/webui.md, docs/env_openai.md: /web, /api/workspace, the new
  state fields, the 75% threshold and the layout deep links

tests/e2e_webui.sh green (permission round-trip, token paths, --web-dev);
make check green.

src/tui.c

@@ -5364,6 +5364,66 @@ static void cmd_quit(tui_t *t, char *arg, int *quit) {
   *quit = 1;
 }
 
+/* /web: the WebUI is a second front end for the same engine and is designed to
+ * run as its own process, so this starts one on the same workspace and leaves
+ * the TUI holding the terminal. The child gets a fresh session: two writers on
+ * one session file is the one thing that would corrupt it. */
+#ifndef _WIN32
+#include <sys/wait.h> /* waitpid: collect the WebUI started by the last /web */
+#endif
+#ifndef CST_WEBUI_DEFAULT_PORT
+#define CST_WEBUI_DEFAULT_PORT 8787 /* keep in sync with include/cst_webui.h */
+#endif
+static void cmd_web(tui_t *t, char *arg, int *quit) {
+  (void)arg;
+  (void)quit;
+#ifdef _WIN32
+  push_system_line(t, "open another terminal and run: cst-agent --web");
+#else
+  static pid_t spawned = 0;
+  if (spawned > 0) {          /* collect the one we started last time */
+    waitpid(spawned, NULL, WNOHANG);
+    spawned = 0;
+  }
+  char dir[4096], exe[4096 + 16];
+  if (os_exe_dir(dir, sizeof(dir)) != 0) {
+    push_system_line(t, "cannot locate this binary: run cst-agent --web yourself");
+    return;
+  }
+  snprintf(exe, sizeof(exe), "%s/cst-agent", dir);
+  const cst_agent_config_t *cfg = cst_agent_config(t->agent);
+  const char *ws = (cfg && cfg->workspace_root[0]) ? cfg->workspace_root : ".";
+  char logf[4096];
+  snprintf(logf, sizeof(logf), "%s/.agent/webui.log", ws);
+  pid_t pid = fork();
+  if (pid < 0) {
+    push_system_line(t, "cannot start a second process");
+    return;
+  }
+  if (pid == 0) {
+    setsid();
+    int fd = open(logf, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+    if (fd >= 0) {
+      dup2(fd, STDOUT_FILENO);
+      dup2(fd, STDERR_FILENO);
+      if (fd > 2)
+        close(fd);
+    }
+    execl(exe, "cst-agent", "--web", "--workspace", ws, "--new", (char *)NULL);
+    _exit(127);
+  }
+  spawned = pid;
+  char msg[4200];
+  snprintf(msg, sizeof(msg),
+           "WebUI started in the background: http://127.0.0.1:%d/ (new session)",
+           CST_WEBUI_DEFAULT_PORT);
+  push_system_line(t, msg);
+  snprintf(msg, sizeof(msg), "its log: %s (port busy? see the log, or pass "
+                             "--web-port)", logf);
+  push_system_line(t, msg);
+#endif
+}
+
 static const slash_cmd_t SLASH[] = {
     {"help", "?", "", "list commands and keys", 1, cmd_help},
     {"new", "clear", "", "start a new session", 0, cmd_new},
@@ -5422,6 +5482,8 @@ static const slash_cmd_t SLASH[] = {
      cmd_agents},
     {"skill", "", "<name> [task]", "run a task with a skill loaded", 0,
      cmd_skill},
+    {"web", "", "", "start the WebUI in the background (127.0.0.1:8787)", 1,
+     cmd_web},
     {"quit", "q exit", "", "quit", 1, cmd_quit},
 };