OpenCode-style TUI, model probing, sandboxed auto approval

- TUI: centered home screen with logo, boxed input with mode line, sidebar
  (>=120 cols), Ctrl+P palette, Tab Build/Plan, Shift+Tab approval cycle,
  mouse (cards, cursor, pickers, wheel), /sidebar /mouse /approval
- /models probing: key check on entry (401 re-asks), API models in /model
- Shell sandbox in C: Linux Landlock (writes limited to workspace/tmp,
  ABI>=4 blocks TCP), macOS sandbox_init, rules fallback elsewhere
- Approval modes ask/auto/yolo (default auto); read-only command whitelist;
  ask to rerun outside the sandbox when a command looks blocked
- Upgradable bootstrap scripts (git pull --ff-only, rebuild, reinstall) and
  cst-agent-update; cst-agent --version
- tests: test_sandbox, test_models

include/cst_perms.h

@@ -23,6 +23,9 @@ int cst_perms_reset(cst_perms_t *p);
 char *cst_perms_describe(const cst_perms_t *p);
 /* Reasonable prefix rule for a command ("" when it should not have one). */
 void cst_perms_suggest_prefix(const char *cmd, char *out, size_t out_sz);
+/* 1 when every segment of cmd (split on | || && ;) is a read-only command
+ * from a fixed whitelist, with no output redirection or substitution. */
+int cst_shell_is_safe(const char *cmd);
 
 #ifdef __cplusplus
 }