v0.8.4: WebUI sessions, diff, settings, slash commands and extensions

Sessions: rename, delete and search; /api/retry regenerates the last
answer, editing a prompt resends from there; /api/export downloads the
transcript as Markdown (cst_session_export_md). Session messages carry
note/tool_result markers, so a reload rebuilds the tool steps with
their arguments, output and exit status; subagent progress is shown.

Diff and settings: /api/diff shows the real diff; /api/settings covers
protocol, max_steps, tool switches and confirm; /api/permissions edits
the rules; sandbox status is reported. Session rename no longer reads
past a short title.

Commands: slash commands with completion in the composer (/model,
/provider, /new, /retry, /undo, /compact, /export, /diff, /init,
/skill and more), a Ctrl+P palette, Shift+Tab cycles the approval
mode, F1 or ? shows the keys. "Thinking expanded" is saved in the
settings (show_thinking), "expand all tool output" in the browser.

Extensions: GET /api/extensions lists MCP servers, plugins, skills,
agent roles and subagent runs; POST /api/extensions/reload and
/api/extensions/trust; a workspace switch reloads them. /api/init and
/api/skill run on the server (cst_init_prompt shared with the TUI).

Errors, statuses and [cst] notes are shown in Chinese with a readable
reason instead of rc=; a failed turn's error survives the reload.

Tests: scripts/e2e_webui_sessions.py, e2e_webui_workspace.py and
e2e_webui_ext.py, run from e2e_webui.sh.

src/agent_loop.c

@@ -2948,13 +2948,18 @@ int cst_agent_new_session(cst_agent_t *a, char *id_out, size_t id_sz) {
     return -1;
   if (cst_agent_store_ensure(a->cfg.workspace_root) != 0)
     return -1;
-  char id[128];
-  if (cst_agent_store_new_id(id, sizeof(id)) != 0)
-    return -1;
-  char path[4096];
-  if (cst_agent_store_path_for_id(a->cfg.workspace_root, id, path,
-                                  sizeof(path)) != 0)
-    return -1;
+  char id[128], path[4096];
+  /* ids are per second: never reopen (and append to) one that exists */
+  for (int tries = 0;; tries++) {
+    if (tries == 16 || cst_agent_store_new_id(id, sizeof(id)) != 0 ||
+        cst_agent_store_path_for_id(a->cfg.workspace_root, id, path,
+                                    sizeof(path)) != 0)
+      return -1;
+    FILE *fp = fopen(path, "rb");
+    if (!fp)
+      break;
+    fclose(fp);
+  }
   if (agent_reopen_session(a, path) != 0)
     return -1;
   cst_agent_store_set_current(a->cfg.workspace_root, id);