v0.8.7: tool capability metadata, in-process engine, Qt app, Android engine

The engine can be embedded now instead of only driven from a terminal: the
same objects link into a Qt front end (app/) that owns a cst_agent_t inside
its own process -- no port, no token, no second process -- and that front end
now runs on the desktop and, engine-side, on the phone.

Capability metadata (include/cst_tools.h, src/tools/registry.c):
- cst_tool_def_t gains perm_name, platforms and available (a probe that
  returns a reason), so a permission is addressable by name and a tool can
  say why it cannot run here.
- cst_platform_name(), cst_tool_platform_ok(), cst_tool_available(),
  cst_tool_meta_reload(), cst_tool_perm_name() and CST_PLAT_DESKTOP[].
- cst_tool_register() may take over a built-in name that is not runnable on
  this platform, so a front end replaces it with its own implementation.
- the registry entries carry their class (delete_file -> "delete"), the
  desktop clipboard tools carry a clipboard probe; find/active/run gate on it.
- /api/settings.tools[] exposes perm_name, platforms, available, why and the
  declared parameters.

Engine as a library (Makefile, CMakeLists.txt):
- libcstcore.a from the CORE_OBJ set, and a CMake cstcore target shared by
  the CLI and by app/ (-DCST_BUILD_APP=ON): the engine is compiled once.
- Android branch for the vendored sashidown: a per-ABI archive built with the
  NDK's aarch64-linux-android24-clang wrapper, because CMake's compiler is
  plain clang and keeps --target/--sysroot in its own variables.

Qt front end (app/, new):
- AgentCore wraps one cst_agent_t: turns run on a worker thread, every
  cst_agent_hooks_t callback becomes a Qt signal, and the two hooks that need
  an answer (on_permission, on_ask_user) block the worker until the GUI
  replies; mode, approval and plan mode go through the engine's config.
- ToolProvider hands the front end's tools to the engine (owner "app:*"); the
  Linux one is notification_send with a probe for notify-send/D-Bus.
- Main.qml: transcript, tool blocks, consent dialog (Deny/Once/Always ->
  CST_PERM_*), ask_user, mode switch, Esc to cancel; --selftest stays
  headless and runs the embedding checks without QML.

Android (scripts/, docs/android.md, new):
- scripts/build_third_party_android.sh builds static mbedTLS + libcurl for an
  ABI (CA path /system/etc/security/cacerts); build_android.sh builds
  cst-agent, libcstcore.a and the test binaries for the phone, can push them
  and run the whole suite there.
- sandbox_exec.c keeps the plain exec path on Android: the seccomp supervisor
  compiled in and the probe reported "seccomp", but writes outside the
  workspace were not denied on the device -- claiming a sandbox that does not
  hold is worse than reporting none.
- tests/test_diff.c compares layouts only against real GNU diffutils: toybox's
  diff prints the same hunk header with its own hunk/context rules.

Tests: test_tool_meta (metadata, platform gate, probe reasons, takeover of a
built-in name) and test_embed (in-process embedding contract) are new; the
existing registry/llm_body assertions now follow availability. 38 test
binaries pass on the host, 36/36 on arm64-v8a Android 16, cst-app-selftest
passes in both the standalone app/ build and the repo build.

Version 0.8.7.

include/cst_tools.h

@@ -62,6 +62,14 @@ typedef int (*cst_tool_run_ex_fn)(const cst_tool_ctx_t *ctx,
                                   const ctl_tool_call_t *call,
                                   cst_tool_result_t *r, void *ud);
 
+/* Platforms a tool exists on, for def.platforms (NULL-terminated).
+ * CST_PLAT_DESKTOP covers linux / win / macos; an app-provided tool can
+ * declare its own, e.g. a static {"android", NULL} in the Qt frontend. */
+extern const char *const CST_PLAT_DESKTOP[];
+/* Host platform: "linux" | "win" | "macos" | "android" | "termux" | "other".
+ * CST_PLATFORM overrides it (tests, cross checks). */
+const char *cst_platform_name(void);
+
 typedef struct {
   const char *name;
   const char *desc;
@@ -81,10 +89,34 @@ typedef struct {
   const char *owner; /* "plugin:<name>", "mcp:<server>", ... */
   /* Non-READ tools that may still join a parallel batch for this call. */
   int (*parallel)(const ctl_tool_call_t *call, void *ud);
+  /* --- capability metadata (discovery + availability) ------------------- */
+  /* Fine-grained policy name for permissions.json and consent UIs
+   * ("read","write","delete","shell","net","notify","device","ui","meta").
+   * NULL falls back to the class name of perm. */
+  const char *perm_name;
+  /* Platforms the tool exists on (NULL = everywhere). A tool that is not
+   * for this host never reaches the prompt or tools[]. */
+  const char *const *platforms;
+  /* Probe: 0 when the tool can run here, -1 with a reason in why (NULL =
+   * always). Keep it cheap (no forks); the answer is cached until
+   * cst_tool_meta_reload(). */
+  int (*available)(char *why, size_t why_sz);
 } cst_tool_def_t;
 
+/* 0 when t exists on this platform. */
+int cst_tool_platform_ok(const cst_tool_def_t *t);
+/* 0 when the tool can run here, -1 with a reason in why. Cached. */
+int cst_tool_available(const cst_tool_def_t *t, char *why, size_t why_sz);
+/* Drop cached probes (a platform service appeared or went away). */
+void cst_tool_meta_reload(void);
+/* Policy name of t: perm_name, or the class default of perm. */
+const char *cst_tool_perm_name(const cst_tool_def_t *t);
+
 /* Add a tool at runtime (strings are copied, ud is not). Safe while turns
- * run; returns 0, or -1 when the name is taken or the table is full. */
+ * run; returns 0, or -1 when the name is taken or the table is full. An
+ * app-provided tool may take a name whose built-in cannot run on this host
+ * (the Android clipboard replacing the xclip one) and then shadows it for
+ * lookups: one capability, one name. */
 int cst_tool_register(const cst_tool_def_t *def);
 /* Drop every dynamic tool of owner (call only while no turn runs). */
 int cst_tool_unregister_owner(const char *owner);