Add batch reads, @file completion, interruptible commands, tool sets

Tools, six built-in to fourteen:
- read_many_files: up to 20 paths read concurrently, each with its own window.
  An unreadable path is reported in its own block instead of throwing.
- multi_edit: several edits to one file, validated in memory first so a late
  failure cannot leave the file half-written.
- list_dir: ignore-aware depth-limited tree.
- git_status/diff/log/show/blame: read-only, spawned with a fixed argv rather
  than a shell string, which is what makes them safe to auto-approve.

toolSets gates them. core is always on; edit-plus and git are optional. A
disabled set reaches neither the wire nor the system prompt, since a prompt
naming an absent tool teaches calls that cannot succeed.

Interface:
- Reasoning streams to a collapsed panel, ctrl-r expands, dropped when the turn
  ends: it is progress, not the answer.
- The tool in flight is named from tool-input-start, before its arguments finish
  streaming, and cleared on its result.
- Prompts typed mid-turn queue and drain in order. esc clears the queue as well
  as aborting.
- @ opens a path picker fed by the ignore-aware walker. Prefix matches rank
  above substring matches, so @src/ means "under src/". The walk runs on the
  first @, not at startup.

ctrl-c kills the command in flight and keeps the turn. The call throws rather
than returning, so the model cannot read a killed command as one that ran and
failed on its own terms. The kill takes the whole process tree: killing cmd /c
alone left the real command holding both pipes open, so the read never returned
and the interrupt did nothing for 19 seconds.

Two pruning fixes:
- A tool result whose tool call was pruned is now dropped with it. Pruning
  counts messages, so the cut landed between an assistant tool-call and the tool
  message answering it, producing 400 "No tool call found for function call
  output with call_id ...". The reverse pairing is left alone: a call awaiting
  its result is what a suspended approval looks like.
- ignore.ts called statFs without importing it, so walk() crashed on the first
  symlink.

482 tests, up from 404. Docs synced across README, ROADMAP, TODO, and all of
docs/: tool sets, the new tools, ctrl-c semantics, the tool-start event, and the
two hand-maintained tool-name lists recorded as a known weakness.

src/cli.tsx

@@ -7,6 +7,7 @@ import { configPath, loadConfig, missingKeyMessage, resolveModel, writeConfigFil
 import type { FallbackEvent } from './fallback';
 import { readStdin, runHeadless } from './headless';
 import { INIT_PROMPT, loadInstructions } from './instructions';
+import { walk } from './ignore';
 import { connectMcp } from './mcp';
 import { Memory, KIND_LABEL } from './memory';
 import { costOf } from './pricing';
@@ -55,6 +56,7 @@ first run: start shiro with no key and it opens provider setup, or use /provider
 config: ${configPath()}
   { "provider": "openai", "model": "gpt-5", "apiKey": "...",
     "agent": "default", "thinking": "medium", "plugins": ["guard", "time"],
+    "toolSets": ["edit-plus", "git"],
     "mcpServers": { "fs": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem", "."] } } }
 
 env:    SHIRO_PROVIDER SHIRO_MODEL SHIRO_BASE_URL SHIRO_API_KEY
@@ -213,6 +215,7 @@ const session = new Session({
   skills,
   plugins,
   agent: agentVariant,
+  ...(cfg.toolSets ? { toolSets: cfg.toolSets } : {}),
   // Headless has no one to answer, so the tool is withheld rather than left to hang.
   ...(headless ? {} : { ask: askBridge.ask }),
   ...(memory ? { memory } : {}),
@@ -253,7 +256,9 @@ if (printArg !== undefined) {
     await shutdown(1);
   }
   if (!yolo) {
-    process.stderr.write('shiro: headless denies write_file, edit_file, bash and mcp tools unless --yolo is passed\n');
+    process.stderr.write(
+      'shiro: headless denies write_file, edit_file, multi_edit, bash and mcp tools unless --yolo is passed\n',
+    );
   }
   const code = await runHeadless({ session, prompt, format: has('--json') ? 'json' : 'text' });
   await shutdown(code);
@@ -270,6 +275,11 @@ const hooks: AppHooks = {
   sessionId: record.id,
   config: () => cfg,
   instructionFiles: () => instructions.map((i) => i.path),
+  listPaths: async () => {
+    const found: string[] = [];
+    for await (const rel of walk({ limit: 5000 })) found.push(rel);
+    return found;
+  },
   initPrompt: INIT_PROMPT,
   history: promptHistory,
   recordPrompt: (text) => void store.appendHistory(text),
@@ -392,12 +402,15 @@ const header = [
   memory && memory.all().length > 0 ? `memory: ${memory.all().length} notes about this project` : undefined,
   mcp && Object.keys(mcp.tools).length > 0 ? `mcp: ${Object.keys(mcp.tools).length} tools` : undefined,
   ...(mcp?.errors ?? []).map((e) => `mcp ${e.server} failed: ${e.message}`),
-  yolo ? 'approvals: OFF (--yolo)' : 'approvals: on for write_file, edit_file, bash, mcp__*',
+  yolo ? 'approvals: OFF (--yolo)' : 'approvals: on for write_file, edit_file, multi_edit, bash, mcp__*',
+  cfg.toolSets ? `tool sets: core, ${cfg.toolSets.join(', ')}` : undefined,
   '/help for commands',
 ]
   .filter(Boolean)
   .join('\n');
 
+// ctrl-c has to reach the App: with a command running it kills that command and
+// keeps the turn. Ink's own handler would exit the process before we saw the key.
 const app = render(
   <App
     session={session}
@@ -409,6 +422,7 @@ const app = render(
     subagents={subagents}
     needsProvider={needsProvider}
   />,
+  { exitOnCtrlC: false },
 );
 await app.waitUntilExit();
 await shutdown(0);