Add batch reads, @file completion, interruptible commands, tool sets

Tools, six built-in to fourteen:
- read_many_files: up to 20 paths read concurrently, each with its own window.
  An unreadable path is reported in its own block instead of throwing.
- multi_edit: several edits to one file, validated in memory first so a late
  failure cannot leave the file half-written.
- list_dir: ignore-aware depth-limited tree.
- git_status/diff/log/show/blame: read-only, spawned with a fixed argv rather
  than a shell string, which is what makes them safe to auto-approve.

toolSets gates them. core is always on; edit-plus and git are optional. A
disabled set reaches neither the wire nor the system prompt, since a prompt
naming an absent tool teaches calls that cannot succeed.

Interface:
- Reasoning streams to a collapsed panel, ctrl-r expands, dropped when the turn
  ends: it is progress, not the answer.
- The tool in flight is named from tool-input-start, before its arguments finish
  streaming, and cleared on its result.
- Prompts typed mid-turn queue and drain in order. esc clears the queue as well
  as aborting.
- @ opens a path picker fed by the ignore-aware walker. Prefix matches rank
  above substring matches, so @src/ means "under src/". The walk runs on the
  first @, not at startup.

ctrl-c kills the command in flight and keeps the turn. The call throws rather
than returning, so the model cannot read a killed command as one that ran and
failed on its own terms. The kill takes the whole process tree: killing cmd /c
alone left the real command holding both pipes open, so the read never returned
and the interrupt did nothing for 19 seconds.

Two pruning fixes:
- A tool result whose tool call was pruned is now dropped with it. Pruning
  counts messages, so the cut landed between an assistant tool-call and the tool
  message answering it, producing 400 "No tool call found for function call
  output with call_id ...". The reverse pairing is left alone: a call awaiting
  its result is what a suspended approval looks like.
- ignore.ts called statFs without importing it, so walk() crashed on the first
  symlink.

482 tests, up from 404. Docs synced across README, ROADMAP, TODO, and all of
docs/: tool sets, the new tools, ctrl-c semantics, the tool-start event, and the
two hand-maintained tool-name lists recorded as a known weakness.

docs/agents.md

@@ -32,9 +32,23 @@ pure latency.
 **`deep`** asks for more than one hypothesis before acting, more reading before concluding,
 and findings recorded with `remember` so they survive compaction.
 
-**`plan`** and **`review`** are genuinely read-only. `write_file`, `edit_file`, and `bash`
-are withheld from the model, not merely discouraged in prose — a model that cannot see a
-tool cannot call it. Their prompts also forbid describing edits as if they had been made.
+**`plan`** and **`review`** are genuinely read-only. `write_file`, `edit_file`, `multi_edit`,
+and `bash` are withheld from the model, not merely discouraged in prose — a model that cannot
+see a tool cannot call it. They keep everything that only reads, including `read_many_files`,
+`list_dir`, and the git tools. Their prompts also forbid describing edits as if they had been
+made.
+
+## Variants and tool sets
+
+Two separate things narrow the tool list, and they compose.
+
+A variant withholds tools by *capability*: `plan` cannot write, whatever the config says.
+`toolSets` withholds them by *cost*: a project that never wants the git tools switches that set
+off for every variant. See [tools](tools.md#tool-sets).
+
+Both go through one function, so a withheld tool is missing from the wire and from the system
+prompt together. `/tools` lists what is actually offered this turn, with the set each tool came
+from.
 
 ## Thinking levels