v0.8.12: attachments in the composer, picker + drop + paste

A prompt can carry files now, and they come in the three ways a desktop user
expects: the 📎 button in the composer (QtQuick.Dialogs' FileDialog), files
dropped anywhere on the window (a DropArea over it, with an accent border and
"drop to attach" while something is dragged), and an image on the clipboard
(Ctrl+V). Text keeps the editor's own paste: the composer asks
AgentCore::clipboardHasImage() first and only takes the keystroke when there is
an image.

AgentCore (app/src/core/AgentCore.*):
- pending is a property now (QStringList) fed by cst_agent_pending_describe();
  attachFile() and attachClipboard() wrap cst_agent_attach_file() /
  cst_agent_attach_bytes(), clearPending() wraps cst_agent_pending_clear(), and
  seesImages() reports whether the model is shown images at all.
- the engine's description says what the model gets ("png 12.0 KB"), not where
  it came from, so the window remembers the names it attached and puts them in
  front: "note.txt — text 21 B".
- pendingChanged() fires on attach, on clear and when a turn ends (the prompt
  consumed the list), which is what makes the chips move.

Engine (src/attach.c):
- cst_attach_describe() printed every sub-megabyte size as "%.0f KB": a 21-byte
  text file came out as "text 0 KB". It is "B", "KB" with one decimal or "MB"
  now, and test_attach still passes.

QML: the composer shows one chip per pending file with "clear all"; the hint
line mentions 📎/Ctrl+V and says when the model is text-only (images then
travel as notes); Main.qml owns the DropArea and the drag feedback.

Verified: 44/44 UI checks (8 new: attach ok, one pending, the name is shown, a
missing file is refused, one chip in the composer, clear all empties it, the
clipboard image is seen and attached), --selftest, make check rc=0 (test_attach
included), and screenshots of the chip row.

Version 0.8.12.

app/README.md

@@ -148,6 +148,33 @@ into the field reaches the engine when "Use this" is clicked, the note says so,
 and Close puts the dialog away. The run points `XDG_CONFIG_HOME` at its scratch
 directory, so settings and keys of the real user are never rewritten.
 
+## Attachments
+
+The next prompt can carry files, and they arrive three ways:
+
+- **📎 in the composer** opens a file picker (`QtQuick.Dialogs`).
+- **Dropping files on the window** — a `DropArea` covers it; while something is
+  dragged over, the border turns accent and says "drop to attach".
+- **Ctrl+V** with an image on the clipboard. Text is left to the editor's own
+  paste: the composer asks `AgentCore::clipboardHasImage()` first and only
+  intercepts the keystroke when there is an image.
+
+`AgentCore::attachFile()` / `attachClipboard()` call `cst_agent_attach_file()` /
+`cst_agent_attach_bytes()`: the engine validates the file, copies it next to
+the session (`.agent/sessions/`), and the next `run_turn` carries it — the
+window only shows what the engine's `pending` list says, one chip per file in
+the engine's own words ("note.txt (text/plain, 21 B)"), with "clear all"
+(`cst_agent_pending_clear`). A prompt consumes the list, so the chips go away
+with the turn. When the model cannot be shown images
+(`cst_agent_sees_images() == 0`), the composer says so and the engine sends
+them as text notes instead.
+
+`--uitest` writes a file into its scratch workspace and checks the whole path:
+`attachFile` succeeds, the engine reports one pending attachment, a missing file
+is refused with a reason, the composer shows one chip, "clear all" empties the
+list, and — with an 8×8 image put on the clipboard — `clipboardHasImage()` and
+`attachClipboard()` behave.
+
 ## Tools the app provides
 
 A tool implemented in the front end is registered with `cst_tool_register()`
@@ -205,7 +232,8 @@ The build flag that keeps Unix helpers out of the picture is
       `--uitest` for mouse, touch and small-screen checks
 - [x] session list in the sidebar: new / switch / delete, transcript replay
 - [x] settings dialog: provider, model, key (`cst_ps_*`), token counters
+- [x] attachments: picker, drop on the window, Ctrl+V image paste
 - [ ] a real turn driven through the window (needs a provider key)
-- [ ] attachments (drag in, paste)
+- [ ] tool results that carry images (they are stored, not drawn yet)
 - [ ] Kirigami (Breeze look), tray, global shortcuts
 - [ ] Android APK (engine in-process, JNI platform tools)