v0.9.0: the Qt front end as an Android APK, images in the transcript

Two strands land together: the window draws pictures now, and the whole front
end builds, installs and runs on the phone with the engine linked in-process.

Images (the "make a picture actually show up" part)
- Engine, additively: cst_agent_hooks_t.on_tool_images(call, list, n, ud) fires
  when a call left attachments behind, and cst_agent_pending_rel() /
  cst_agent_pending_is_image() read that list without the app touching the
  store. tests/test_attach.c::test_agent_pending pins the three cases (an
  image, a stored name that passes cst_attach_rel_ok, out-of-range NULL).
- App: image://cstattach/<stored name> (app/src/ui/SessionImages.cpp) serves
  only the current session's attachment directory, checked with
  cst_attach_rel_ok, decodes down to the requested sourceSize and never
  upscales, and holds a mutex because requestImage() runs on the render
  thread while the directory can change underneath it. AgentCore gained
  attachmentDir(), pendingImages(), the toolImages()/promptImages() signals
  and hookToolImages(); history() gives replayed rows their images too.
- QML: ImageStrip.qml (a thumb strip, <=150 px tall, shaped by the picture,
  tooltip with name/size/origin, the file's name when it went missing),
  wired into MessageCard and ToolCard. Qt 6's ListModel cannot hold a
  list-valued role (append() reads back undefined, setProperty drops it), so
  a row carries one image per line as <stored>|<name>|<origin>|<w>x<h> and
  ImageStrip decodes that.

Android (the engine is already in the APK; this is the front end)
- app/src/main.cpp: on Android the workspace, config, tmp and HOME go under
  the app's own data directory before the engine opens anything, because
  QDir::currentPath() is "/" there and /tmp is not writable.
- app/android/: the manifest (QtApplication/QtActivity, INTERNET and
  POST_NOTIFICATIONS, adjustResize, no storage permission -- the picker will
  be the system one), strings, a vector icon; minSdk 24 and targetSdk 35 come
  from app/CMakeLists.txt through QT_ANDROID_MIN/TARGET_SDK_VERSION.
- app/src/platform/android/AndroidTools.cpp: the Android file behind
  PlatformInit(), owner "app:android" (notification, clipboard, share sheet,
  file picker are stubs for now, so the tool list does not lie about them).
- app/tools/selftest.c decides its scratch workspace with os_temp_dir(), so
  the C smoke test runs on the device too.
- scripts/build_apk_android.sh: sources to installed APK in one command
  (environment checks, qt-cmake configure, --target apk, adb install), and
  the host-side plumbing the NixOS + qt.io combination needs -- the NDK
  sysroot include dirs for Qt's FindGLESv2/FindEGL (they only look under
  <sysroot>/include), -L$PREFIX/lib on the shared/module link lines as well
  as the executables', the Android debug keystore created on first use with
  QT_ANDROID_SIGN_APK + QT_ANDROID_KEYSTORE_* (androiddeployqt copies the
  unsigned gradle output and signs it itself), and the #!/bin/bash shebang of
  the build-tools wrappers, which NixOS does not have.
- scripts/gradle-android-init.gradle (installed into ~/.gradle/init.d/): the
  release lint task is switched off -- lintVitalAnalyzeRelease resolves its
  own tool jars straight from dl.google.com, bypassing every repository the
  build configures, and fails the build after all the real work is done.
- Icons: app/icons/*.svg (Breeze's 24@3x files, the 19 names the window asks
  for) are compiled in as :/cst-icons and ThemeIcons.cpp falls back to them
  when the platform has no icon theme. On the phone the Qt theme lookup found
  nothing and the QML glyph fallback was an empty box in the phone's fonts.
- docs/android.md: "The APK (Qt front end)" -- the SDK assembled without
  sdkmanager, the host Qt's missing libraries on NixOS, the Gradle mirrors,
  lint, signing -- and a Status that says what runs where. app/README.md
  gains the images and APK lines, and stops claiming Android platform tools
  that are still stubs.

Verified: engine `make check` green; desktop `cst-app-selftest: OK` and
--uitest all checks pass; phone (NX789J, Android 16, arm64-v8a) -- the APK
installs, starts on the workspace under /data/user/0/xyz.whcself.cstagent/
files/, a turn reaches a configured provider over HTTPS from inside the ART
process and renders the reply, rotation keeps the session and docks the
sidebar, and the toolbar/card icons draw.

Version 0.9.0.

mode = coding

app/README.md

@@ -212,6 +212,27 @@ is refused with a reason, the composer shows one chip, "clear all" empties the
 list, and — with an 8×8 image put on the clipboard — `clipboardHasImage()` and
 `attachClipboard()` behave.
 
+## Images
+
+What a session keeps as a picture is shown, not only stored: a file
+`view_image` returned, an image an MCP server sent, a screenshot the user
+attached or pasted. Each one appears as a thumbnail in the transcript -- a
+prompt's pictures under the message, a tool's under its card -- with the name,
+size and origin in the tooltip. The height is capped so a 4K screenshot cannot
+push the conversation off the screen, and a file the store no longer has says
+which image it was instead of leaving a hole.
+
+The view never touches the filesystem on its own authority: the thumbnails
+come from `image://cstattach/<stored name>` (`app/src/ui/SessionImages.cpp`),
+where the name is the one the engine wrote next to the session and is checked
+with the engine's own `cst_attach_rel_ok()`, so only the session's attachment
+directory can be read. The picture is decoded at the size of its thumbnail
+rather than at its full resolution, and the provider's directory follows the
+session: `AgentCore::attachmentDir()` is re-read on every switch.
+
+A document (PDF, UTF-8 text) still arrives as its name in the message text --
+those are sent to the model as text, not as a picture.
+
 ## Transcript, tool calls, streaming text
 
 - A tool call is a card of its own, and the call **id** is what pairs it with
@@ -307,7 +328,7 @@ GUI only through queued signals.
 |---|---|---|
 | Linux | `cmake -S app -B build-app` (libcurl via pkg-config) | clipboard (shell helpers), notification (`notify-send` / D-Bus) |
 | Windows | Qt's MinGW kit, `cmake -G Ninja -DCMAKE_PREFIX_PATH=<Qt>/lib/cmake`; the engine needs libcurl for Windows (see `docs/README-windows.md`) | notification via the WinRT/tray API, clipboard through the core's Win32 path |
-| Android | engine compiled with the NDK inside the APK (`-DCST_TUI=0`, `CST_NO_WEBUI=1`); the app talks to Android APIs through Qt (JNI) | notification (Android), share sheet, clipboard, file picker |
+| Android | engine compiled with the NDK inside the APK (`scripts/build_apk_android.sh`, `-DCST_TUI=0`, `CST_NO_WEBUI=1`); no port, QML talks to `AgentCore` in-process | none yet: `app/src/platform/android/AndroidTools.cpp` is a stub, so notification, share sheet, clipboard and the file picker are still missing |
 | macOS | Qt from the installer, libcurl from the system | notification (`osascript`), clipboard (`pbpaste`/`pbcopy`) |
 
 Android's long-term shape: the core lives in the APK (no Termux needed), the
@@ -328,8 +349,12 @@ The build flag that keeps Unix helpers out of the picture is
 - [x] attachments: picker, drop on the window, Ctrl+V image paste
 - [x] icons from the desktop's icon theme (Breeze), with a glyph fallback
 - [x] contrast pass: faint text and selected rows are readable
+- [x] images in the transcript: tool results and attachments are drawn as
+      thumbnails (`image://cstattach/<stored name>`, see the Images section)
+- [x] Android APK: the engine is linked in (no port), builds, installs under
+      `xyz.whcself.cstagent` and runs on the device (see `docs/android.md`)
 - [ ] a real turn driven through the window (needs a provider key)
-- [ ] tool results that carry images (they are stored, not drawn yet)
+- [ ] Android platform tools (JNI: notification, share sheet, clipboard, file
+      picker), the back gesture, the icon glyphs on the phone
 - [ ] Kirigami (the rest of the Breeze look: colors, controls), tray,
       global shortcuts
-- [ ] Android APK (engine in-process, JNI platform tools)