OpenCode-style TUI, model probing, sandboxed auto approval

- TUI: centered home screen with logo, boxed input with mode line, sidebar
  (>=120 cols), Ctrl+P palette, Tab Build/Plan, Shift+Tab approval cycle,
  mouse (cards, cursor, pickers, wheel), /sidebar /mouse /approval
- /models probing: key check on entry (401 re-asks), API models in /model
- Shell sandbox in C: Linux Landlock (writes limited to workspace/tmp,
  ABI>=4 blocks TCP), macOS sandbox_init, rules fallback elsewhere
- Approval modes ask/auto/yolo (default auto); read-only command whitelist;
  ask to rerun outside the sandbox when a command looks blocked
- Upgradable bootstrap scripts (git pull --ff-only, rebuild, reinstall) and
  cst-agent-update; cst-agent --version
- tests: test_sandbox, test_models

include/cst_agent.h

@@ -73,10 +73,23 @@ typedef struct {
   int confirm_write;  /* confirm file-changing tools */
   int confirm_net;    /* confirm web_fetch */
   int auto_approve;   /* headless / CST_AUTO_APPROVE=1 / --yolo */
+  int approval;       /* cst_approval_t (interactive sessions) */
+  int plan_mode;      /* read-only tools + planning note */
   int tool_profile;   /* cst_tool_profile_t (CST_TOOLS) */
   unsigned long long tools_off; /* bit i = registry tool i disabled */
 } cst_agent_config_t;
 
+/* ask: confirm per tool; auto: sandbox/rules decide, ask on doubt; yolo: never
+ * ask (same as auto_approve). */
+typedef enum {
+  CST_APPROVAL_ASK = 0,
+  CST_APPROVAL_AUTO,
+  CST_APPROVAL_YOLO
+} cst_approval_t;
+#define CST_DEFAULT_APPROVAL CST_APPROVAL_AUTO
+const char *cst_approval_name(int a);
+int cst_approval_parse(const char *s, int *out);
+
 typedef struct cst_session cst_session_t;
 typedef struct cst_agent cst_agent_t;
 
@@ -143,6 +156,10 @@ int cst_tool_read_file(const char *workspace_root, const ctl_tool_call_t *call,
                        cst_tool_result_t *r);
 int cst_tool_run_shell(const char *workspace_root, const ctl_tool_call_t *call,
                        cst_tool_result_t *r);
+/* sandboxed: confine the command with the OS sandbox (cst_sandbox.h). */
+int cst_tool_run_shell_ex(const char *workspace_root,
+                          const ctl_tool_call_t *call, cst_tool_result_t *r,
+                          int sandboxed);
 int cst_tool_apply_patch(const char *workspace_root, const ctl_tool_call_t *call,
                          cst_tool_result_t *r);
 int cst_tool_write_file(const char *workspace_root, const ctl_tool_call_t *call,
@@ -206,6 +223,14 @@ typedef struct {
 } cst_llm_request_t;
 
 int cst_llm_chat_stream(const cst_llm_request_t *req, char *err, size_t err_sz);
+
+/* GET {api_base}/models (10 s timeout). Returns the number of model ids
+ * written, CST_MODELS_AUTH when the key is rejected (401/403), or -1 on
+ * network / format errors. */
+#define CST_MODELS_AUTH (-2)
+int cst_llm_list_models(const char *api_base, const char *api_key,
+                        char out[][128], int max_out, char *err,
+                        size_t err_sz);
 /* JSON request body (malloc'd) exactly as sent on the wire. */
 char *cst_llm_build_body(const cst_llm_request_t *req);
 /* Reset the CST_RECORD_SSE / CST_REPLAY_SSE sequence counter. */
@@ -216,6 +241,10 @@ void cst_llm_trace_reset(void);
 #define CST_PERM_ONCE 1
 #define CST_PERM_ALWAYS_TOOL 2   /* saved to .agent/permissions.json */
 #define CST_PERM_ALWAYS_PREFIX 3 /* run_shell: allow this command prefix */
+/* on_permission detail prefix when a sandboxed run_shell looked blocked and
+ * the question is whether to rerun it outside the sandbox. The rest of the
+ * detail is the tail of the sandboxed output. */
+#define CST_PERM_SANDBOX "[sandbox] "
 
 /* Live UI / observability hooks for a turn */
 typedef struct {
@@ -297,6 +326,7 @@ int cst_creds_prompt_console(const char *provider, char *out, size_t out_sz);
 typedef struct {
   char provider[32];
   char effort[16];
+  char approval[8]; /* "" = not chosen yet */
   int nmodels;
   struct {
     char provider[32];
@@ -308,6 +338,8 @@ int cst_settings_save(const cst_settings_t *s);
 const char *cst_settings_model(const cst_settings_t *s, const char *provider);
 /* Record cfg's provider, model and effort as the last used ones. */
 int cst_settings_remember(const cst_agent_config_t *cfg);
+/* Record an approval mode the user picked (CST_APPROVAL_*). */
+int cst_settings_remember_approval(int approval);
 
 /* JSON baseline parser for experiments (buffer until valid object). */
 typedef struct {