Usability pass: tool registry, TUI polish, saved keys and settings

Tools
- Table-driven tool registry with permission classes and default/minimal
  profiles; new tools: edit_file, list_dir, glob, grep, delete_file,
  move_file, todo_write, web_fetch, ask_user (plus read_file paging).
- Built-in Myers diff; write tools return unified diffs.
- Persistent permission rules (.agent/permissions.json), per-turn undo
  snapshots (.agent/undo), AGENTS.md project notes, auto-compact at 80%
  of the model context, cancellable run_shell with process-group kill.

TUI
- Table-driven slash commands: /provider /key /effort /status /tools
  /permissions /yolo /undo /retry /diff /export /copy /rename /delete
  /init /max-steps /todo, with / and @ completion.
- Permission modal with diff and prefix rules, ask_user modal, todo
  panel, header with model/effort/context, bracketed paste, line editing,
  wide-char cursor, NO_COLOR and ASCII fallback; Esc never quits.

Startup and configuration
- API keys are entered in the TUI (hidden) and saved per provider in
  <config>/credentials (0600); env variables are only a fallback.
- Last provider, per-provider model and reasoning effort are remembered
  in <config>/settings.json; --effort/-e and /effort send
  reasoning_effort (low|medium|high|max) to models that accept it.
- DeepSeek preset uses deepseek-flash / deepseek-v4-pro.
- Session flags --new/--continue/--resume/--list-sessions, --yolo,
  --confirm.

Compatibility and tests
- ncurses detection, macOS/Homebrew support, make install, XDG config
  dir, POSIX cleanups; Gitea CI (gcc/clang/asan/musl/macOS).
- Unit tests for diff, fs tools, registry, undo/perms and config;
  e2e fixtures multi_file_refactor and ask_or_todo; vendored cJSON.

.gitea/workflows/ci.yml

@@ -0,0 +1,75 @@
+name: ci
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  linux:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        cc: [gcc, clang]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install dependencies
+        run: |
+          SUDO=$(command -v sudo || true)
+          $SUDO apt-get update
+          $SUDO apt-get install -y --no-install-recommends \
+            build-essential clang cmake pkg-config python3 \
+            libcurl4-openssl-dev libncurses-dev
+      - name: Build (warnings are errors)
+        run: make CC=${{ matrix.cc }} CFLAGS="-std=c11 -Wall -Wextra -O2 -g -Werror" -j"$(nproc)"
+      - name: Unit tests
+        run: make CC=${{ matrix.cc }} check
+      - name: CMake build + ctest
+        run: |
+          cmake -B build -DCMAKE_C_COMPILER=${{ matrix.cc }} -DCST_BUILD_TUI=ON
+          cmake --build build -j"$(nproc)"
+          ctest --test-dir build --output-on-failure
+      - name: Smoke test
+        run: |
+          ./cst-agent --help
+          ./cst-agent --workspace "$PWD" --list-sessions
+          ./cst-agent --demo-ctl --workspace .
+
+  sanitizers:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install dependencies
+        run: |
+          SUDO=$(command -v sudo || true)
+          $SUDO apt-get update
+          $SUDO apt-get install -y --no-install-recommends \
+            build-essential pkg-config libcurl4-openssl-dev libncurses-dev
+      - name: ASan + UBSan
+        run: make asan
+
+  musl:
+    runs-on: ubuntu-latest
+    container: alpine:3.20
+    steps:
+      - name: Install dependencies
+        run: apk add --no-cache build-base pkgconf curl-dev ncurses-dev git nodejs bash python3
+      - uses: actions/checkout@v4
+      - name: Build + unit tests
+        run: |
+          make CFLAGS="-std=c11 -Wall -Wextra -O2 -Werror" -j"$(nproc)"
+          make check
+
+  # Gitea instances rarely have macOS runners; set the repository variable
+  # HAVE_MACOS_RUNNER=true once one is registered.
+  macos:
+    if: ${{ vars.HAVE_MACOS_RUNNER == 'true' }}
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install dependencies
+        run: brew install ncurses curl pkg-config
+      - name: Build + unit tests
+        run: |
+          make -j"$(sysctl -n hw.ncpu)"
+          make check