OpenCode-style TUI, model probing, sandboxed auto approval

- TUI: centered home screen with logo, boxed input with mode line, sidebar
  (>=120 cols), Ctrl+P palette, Tab Build/Plan, Shift+Tab approval cycle,
  mouse (cards, cursor, pickers, wheel), /sidebar /mouse /approval
- /models probing: key check on entry (401 re-asks), API models in /model
- Shell sandbox in C: Linux Landlock (writes limited to workspace/tmp,
  ABI>=4 blocks TCP), macOS sandbox_init, rules fallback elsewhere
- Approval modes ask/auto/yolo (default auto); read-only command whitelist;
  ask to rerun outside the sandbox when a command looks blocked
- Upgradable bootstrap scripts (git pull --ff-only, rebuild, reinstall) and
  cst-agent-update; cst-agent --version
- tests: test_sandbox, test_models

src/settings.c

@@ -40,6 +40,8 @@ int cst_settings_load(cst_settings_t *s) {
            cJSON_GetObjectItemCaseSensitive(root, "provider"));
   copy_str(s->effort, sizeof(s->effort),
            cJSON_GetObjectItemCaseSensitive(root, "effort"));
+  copy_str(s->approval, sizeof(s->approval),
+           cJSON_GetObjectItemCaseSensitive(root, "approval"));
   const cJSON *models = cJSON_GetObjectItemCaseSensitive(root, "models");
   const cJSON *m;
   cJSON_ArrayForEach(m, models) {
@@ -69,6 +71,8 @@ int cst_settings_save(const cst_settings_t *s) {
     cJSON_AddStringToObject(root, "provider", s->provider);
   if (s->effort[0])
     cJSON_AddStringToObject(root, "effort", s->effort);
+  if (s->approval[0])
+    cJSON_AddStringToObject(root, "approval", s->approval);
   cJSON *models = cJSON_AddObjectToObject(root, "models");
   for (int i = 0; i < s->nmodels; i++)
     cJSON_AddStringToObject(models, s->models[i].provider, s->models[i].model);
@@ -93,6 +97,22 @@ int cst_settings_save(const cst_settings_t *s) {
   return rc;
 }
 
+static const char *const APPROVAL_NAMES[] = {"ask", "auto", "yolo"};
+
+const char *cst_approval_name(int a) {
+  return a >= 0 && a <= CST_APPROVAL_YOLO ? APPROVAL_NAMES[a] : "auto";
+}
+
+int cst_approval_parse(const char *s, int *out) {
+  for (int i = 0; s && i <= CST_APPROVAL_YOLO; i++) {
+    if (strcmp(s, APPROVAL_NAMES[i]) == 0) {
+      *out = i;
+      return 0;
+    }
+  }
+  return -1;
+}
+
 const char *cst_settings_model(const cst_settings_t *s, const char *provider) {
   for (int i = 0; provider && i < s->nmodels; i++) {
     if (strcmp(s->models[i].provider, provider) == 0 && s->models[i].model[0])
@@ -119,3 +139,10 @@ int cst_settings_remember(const cst_agent_config_t *cfg) {
   snprintf(s.models[i].model, sizeof(s.models[i].model), "%s", cfg->model);
   return cst_settings_save(&s);
 }
+
+int cst_settings_remember_approval(int approval) {
+  cst_settings_t s;
+  cst_settings_load(&s);
+  snprintf(s.approval, sizeof(s.approval), "%s", cst_approval_name(approval));
+  return cst_settings_save(&s);
+}