v0.8.8: Qt front end redesign, responsive shell, UI input tests

The window is no longer one file pretending to be a chat box. The transcript,
the run panel, the composer and the two consent dialogs are their own QML
components over one Theme singleton, and the shell around them adapts to the
screen: docked and scrollable on a desktop, a slide-out drawer on a phone.

QML (app/qml/, new except Main.qml):
- Theme.qml: single QML singleton, dark Breeze-flavoured tokens (surface,
  border, accent, text/textDim/textFaint, radius, pad, gap, sizes, monospace);
  diffLineColor() for unified-diff rows, compactBreakpoint 880, touchTarget
  34, segmentHeight 30, headerHeight 42.
- ChatView.qml: a row-type dispatcher over the transcript model (message,
  thought, tool, note), follow-the-tail scrolling with a "jump to latest"
  button once the user scrolls up, and an empty state that says where the
  agent runs and what it can do.
- MessageCard.qml, ThinkBlock.qml, NoteLine.qml, ToolCard.qml (status pill,
  arguments, collapsible output, 500-line cut, diff colouring, spinner while
  the call runs), TodoPanel.qml.
- Sidebar.qml: workspace/provider/status, mode and approval segmented rows,
  plan switch, the engine's todo list, version footer; scrolls, so a short
  window still reaches every control.
- Composer.qml: auto-growing field, Enter sends / Shift+Enter newlines,
  red Stop while a turn runs, autocorrect hints off, finger-sized targets.
- ConsentDialog.qml (Deny / Once / Always -> CST_PERM_*) and AskDialog.qml
  (the model's options become buttons, free text stays possible).
- Main.qml: shell with header, draggable sidebar splitter (hover feedback,
  200-560 px, double-click resets), transcript, composer, the two dialogs,
  Esc to cancel and Ctrl+L to clear. Under 880 px the sidebar becomes a
  drawer with a scrim instead of squeezing the chat away.

AgentCore / main.cpp:
- provider, model, approval and planMode are properties now; approval and
  plan mode write back into the engine's config, and renderMarkdown() calls
  cst_web_md_html(), so a table or a code fence looks like the WebUI's.
- the todo hook writes m_todo on the GUI thread (it was written from the
  worker thread before: a data race on a QString member).
- --size WxH for the window (the layout tests drive it), and the Basic style
  is chosen by default: the Breeze Quick style registers its types with
  relative URLs, which floods the log and breaks the composer.

UI tests (app/src/ui/):
- --uitest drives the real window with synthesized input and exits with the
  number of failures: 15 checks over docking/drawer transitions, mouse clicks
  and touch taps reaching the engine's mode, the plan switch, the composer
  arming the send button, and a 460x900 -> 1200x820 resize round trip.
- every control the tests touch carries an objectName; the sidebar's
  implicitHeight binding loop is gone.

Tests: cst-app-selftest and --uitest pass in the standalone app build,
ctest cst-app-selftest passes in the repo build (38/38 on the host).

Version 0.8.8.

app/src/core/AgentCore.cpp

@@ -5,6 +5,10 @@
 #include <QFileInfo>
 #include <QThread>
 
+#include <cstdlib>
+
+#include "cst_web_md.h"
+
 /* --- the worker thread --------------------------------------------------- */
 
 /* One turn: the whole cst_agent_run_turn_ex() call, on its own thread. The
@@ -80,9 +84,23 @@ bool AgentCore::open(const QString &workspace, const QString &provider,
   }
   /* The session file is created by the engine; attachments live next to it. */
   emit workspaceChanged();
+  emit configChanged();
   return true;
 }
 
+/* The engine already renders markdown for the WebUI; the window uses the same
+ * renderer, so a table or a code fence looks the same in both front ends. */
+QString AgentCore::renderMarkdown(const QString &text) const {
+  const QByteArray in = text.toUtf8();
+  char *html = cst_web_md_html(in.constData(), static_cast<size_t>(in.size()));
+  if (!html)
+    return text.toHtmlEscaped().replace(QLatin1Char('\n'),
+                                        QStringLiteral("<br>"));
+  const QString out = QString::fromUtf8(html);
+  free(html);
+  return out;
+}
+
 void AgentCore::close() {
   if (!m_agent)
     return;
@@ -215,12 +233,14 @@ void AgentCore::setApproval(int approval) {
   m_cfg.approval = approval;
   if (m_agent)
     cst_agent_config_mut(m_agent)->approval = approval;
+  emit approvalChanged();
 }
 
 void AgentCore::setPlanMode(bool on) {
   m_cfg.plan_mode = on ? 1 : 0;
   if (m_agent)
     cst_agent_config_mut(m_agent)->plan_mode = m_cfg.plan_mode;
+  emit planModeChanged();
 }
 
 /* --- tools the front end provides ---------------------------------------- */
@@ -279,5 +299,9 @@ void AgentCore::hookToolResult(const ctl_tool_call_t *call, const char *out,
 void AgentCore::hookTodo(const char *text, void *ud) {
   AgentCore *self = static_cast<AgentCore *>(ud);
   const QString t = QString::fromUtf8(text ? text : "");
-  self->post([self, t] { emit self->todoChanged(t); });
+  /* Runs on the worker thread: touch m_todo on the GUI thread only. */
+  self->post([self, t] {
+    self->m_todo = t;
+    emit self->todoChanged(t);
+  });
 }