Add batch reads, @file completion, interruptible commands, tool sets

Tools, six built-in to fourteen:
- read_many_files: up to 20 paths read concurrently, each with its own window.
  An unreadable path is reported in its own block instead of throwing.
- multi_edit: several edits to one file, validated in memory first so a late
  failure cannot leave the file half-written.
- list_dir: ignore-aware depth-limited tree.
- git_status/diff/log/show/blame: read-only, spawned with a fixed argv rather
  than a shell string, which is what makes them safe to auto-approve.

toolSets gates them. core is always on; edit-plus and git are optional. A
disabled set reaches neither the wire nor the system prompt, since a prompt
naming an absent tool teaches calls that cannot succeed.

Interface:
- Reasoning streams to a collapsed panel, ctrl-r expands, dropped when the turn
  ends: it is progress, not the answer.
- The tool in flight is named from tool-input-start, before its arguments finish
  streaming, and cleared on its result.
- Prompts typed mid-turn queue and drain in order. esc clears the queue as well
  as aborting.
- @ opens a path picker fed by the ignore-aware walker. Prefix matches rank
  above substring matches, so @src/ means "under src/". The walk runs on the
  first @, not at startup.

ctrl-c kills the command in flight and keeps the turn. The call throws rather
than returning, so the model cannot read a killed command as one that ran and
failed on its own terms. The kill takes the whole process tree: killing cmd /c
alone left the real command holding both pipes open, so the read never returned
and the interrupt did nothing for 19 seconds.

Two pruning fixes:
- A tool result whose tool call was pruned is now dropped with it. Pruning
  counts messages, so the cut landed between an assistant tool-call and the tool
  message answering it, producing 400 "No tool call found for function call
  output with call_id ...". The reverse pairing is left alone: a call awaiting
  its result is what a suspended approval looks like.
- ignore.ts called statFs without importing it, so walk() crashed on the first
  symlink.

482 tests, up from 404. Docs synced across README, ROADMAP, TODO, and all of
docs/: tool sets, the new tools, ctrl-c semantics, the tool-start event, and the
two hand-maintained tool-name lists recorded as a known weakness.

docs/memory.md

@@ -135,23 +135,46 @@ and outcomes, what remains — and it replaces the transcript entirely.
 
 ### The pruning repair
 
-`pruneMessages({ reasoning: 'all' })` strips a reasoning item and keeps the message item from
-the same response. The OpenAI responses API treats the message as a dependent of that
-reasoning item and rejects the request:
+Pruning breaks two provider invariants. `src/prune.ts` repairs both, and both were real 400s
+before it did.
+
+**A message without its reasoning item.** `pruneMessages({ reasoning: 'all' })` strips a
+reasoning item and keeps the message item from the same response. The OpenAI responses API
+treats the message as a dependent of that reasoning item and rejects the request:
 
 ```
 400 Item 'msg_…' of type 'message' was provided without its required 'reasoning' item: 'rs_…'
 ```
 
 The two carry different ids, so they cannot be matched by id. What links them is the
-assistant message they arrived in — one message is one response. `src/prune.ts` drops the
+assistant message they arrived in — one message is one response. `dropOrphanedItems` drops the
 dependent parts of any turn whose reasoning was removed. That costs nothing, because pruning
 was already discarding those turns.
 
+**A tool result without its tool call.** `toolCalls: 'before-last-3-messages'` counts
+*messages*, not pairs, so the cut can land between the assistant message holding a `tool-call`
+and the `tool` message answering it:
+
+```
+400 No tool call found for function call output with call_id call_…
+```
+
+`dropOrphanedResults` drops any result whose call id no longer survives. The reverse is left
+alone deliberately: a tool call still waiting for its result is what a suspended approval looks
+like, and dropping it would break `/resume`.
+
 ## Prompt history
 
 Per-directory, capped at 200, deduplicated against the previous entry. Up and down in the
-input walk it; down past the newest restores what you were typing.
+input walk it; down past the newest restores what you were typing. While an `@` token is open
+those keys move in the file picker instead.
 
 Stored at `~/.shiro-neko/history/<hash>.json`, where the hash is a SHA-256 prefix of the
 project path.
+
+## The prompt queue
+
+Not persisted, and deliberately so. A prompt typed during a turn lives in memory until the turn
+ends, then runs. `esc` clears it along with aborting the turn, and quitting discards it — a
+queued thought that fires on next launch, against a workspace that has since changed, is worse
+than a lost one.