OpenCode-style TUI, model probing, sandboxed auto approval

- TUI: centered home screen with logo, boxed input with mode line, sidebar
  (>=120 cols), Ctrl+P palette, Tab Build/Plan, Shift+Tab approval cycle,
  mouse (cards, cursor, pickers, wheel), /sidebar /mouse /approval
- /models probing: key check on entry (401 re-asks), API models in /model
- Shell sandbox in C: Linux Landlock (writes limited to workspace/tmp,
  ABI>=4 blocks TCP), macOS sandbox_init, rules fallback elsewhere
- Approval modes ask/auto/yolo (default auto); read-only command whitelist;
  ask to rerun outside the sandbox when a command looks blocked
- Upgradable bootstrap scripts (git pull --ff-only, rebuild, reinstall) and
  cst-agent-update; cst-agent --version
- tests: test_sandbox, test_models

docs/env_openai.md

@@ -76,7 +76,9 @@ export OPENAI_MODEL='your-model'
 | `CST_METRICS=0` / `CST_METRICS_PATH` | 关闭 / 指定计时埋点 JSONL |
 | `CST_RECORD_SSE` / `CST_REPLAY_SSE` | 录制 / 回放原始 SSE 流目录；`CST_REPLAY_CHUNK` 控制回放分块字节数 |
 | `CST_MODELS` | `/model` 可选列表，`:` 或 `,` 分隔 |
-| `CST_AUTO_APPROVE=1` | 自动允许 shell/写文件（headless 默认开启） |
+| `CST_AUTO_APPROVE=1` | 自动允许 shell/写文件（= `--approval yolo`；headless 默认开启） |
+| `CST_APPROVAL` | 审批模式 `ask` / `auto`（默认）/ `yolo` |
+| `CST_SANDBOX=off` | 关闭 run_shell 沙箱（Landlock / macOS sandbox），`auto` 回落到只读白名单 |
 | `CST_SHELL` | shell 解释器路径（覆盖 busybox/`sh`） |
 | `CST_EXE_DIR` | 可执行文件目录（Termux 旁路 busybox 时有用） |