Add batch reads, @file completion, interruptible commands, tool sets

Tools, six built-in to fourteen:
- read_many_files: up to 20 paths read concurrently, each with its own window.
  An unreadable path is reported in its own block instead of throwing.
- multi_edit: several edits to one file, validated in memory first so a late
  failure cannot leave the file half-written.
- list_dir: ignore-aware depth-limited tree.
- git_status/diff/log/show/blame: read-only, spawned with a fixed argv rather
  than a shell string, which is what makes them safe to auto-approve.

toolSets gates them. core is always on; edit-plus and git are optional. A
disabled set reaches neither the wire nor the system prompt, since a prompt
naming an absent tool teaches calls that cannot succeed.

Interface:
- Reasoning streams to a collapsed panel, ctrl-r expands, dropped when the turn
  ends: it is progress, not the answer.
- The tool in flight is named from tool-input-start, before its arguments finish
  streaming, and cleared on its result.
- Prompts typed mid-turn queue and drain in order. esc clears the queue as well
  as aborting.
- @ opens a path picker fed by the ignore-aware walker. Prefix matches rank
  above substring matches, so @src/ means "under src/". The walk runs on the
  first @, not at startup.

ctrl-c kills the command in flight and keeps the turn. The call throws rather
than returning, so the model cannot read a killed command as one that ran and
failed on its own terms. The kill takes the whole process tree: killing cmd /c
alone left the real command holding both pipes open, so the read never returned
and the interrupt did nothing for 19 seconds.

Two pruning fixes:
- A tool result whose tool call was pruned is now dropped with it. Pruning
  counts messages, so the cut landed between an assistant tool-call and the tool
  message answering it, producing 400 "No tool call found for function call
  output with call_id ...". The reverse pairing is left alone: a call awaiting
  its result is what a suspended approval looks like.
- ignore.ts called statFs without importing it, so walk() crashed on the first
  symlink.

482 tests, up from 404. Docs synced across README, ROADMAP, TODO, and all of
docs/: tool sets, the new tools, ctrl-c semantics, the tool-start event, and the
two hand-maintained tool-name lists recorded as a known weakness.

src/ignore.ts

@@ -1,5 +1,5 @@
 import { isAbsolute, join, relative, resolve } from 'node:path';
-import { readdir as readdirFs } from 'node:fs/promises';
+import { readdir as readdirFs, stat as statFs } from 'node:fs/promises';
 
 const ALWAYS_SKIP = ['.git', 'node_modules'];
 
@@ -109,10 +109,16 @@ export async function* walk(options: WalkOptions = {}): AsyncGenerator<string> {
     const { dir, rules } = queue.shift()!;
     let entries: Entry[];
     try {
-      entries = (await readdirFs(dir, { withFileTypes: true })).map((d) => ({
-        name: d.name,
-        isDirectory: d.isDirectory(),
-      }));
+      entries = await Promise.all(
+        (await readdirFs(dir, { withFileTypes: true })).map(async (d) => ({
+          name: d.name,
+          // readdir reports a symlinked directory as a non-directory, which made
+          // junctions leak past `dir/` ignore rules and be yielded as files with a
+          // nonsense size. One stat per link fixes the classification.
+          isDirectory: d.isDirectory() || (d.isSymbolicLink() && (await isDirLink(join(dir, d.name)))),
+          isLink: d.isSymbolicLink(),
+        })),
+      );
     } catch {
       continue;
     }
@@ -124,6 +130,9 @@ export async function* walk(options: WalkOptions = {}): AsyncGenerator<string> {
       if (!options.noIgnore && ignored(rel, entry.isDirectory, rules)) continue;
 
       if (entry.isDirectory) {
+        // A symlinked directory is not descended into: it can point anywhere,
+        // including back into the tree.
+        if (entry.isLink) continue;
         const nested = options.noIgnore ? rules : [...rules, ...(await rulesIn(root, full))];
         queue.push({ dir: full, rules: nested });
       } else {
@@ -134,7 +143,15 @@ export async function* walk(options: WalkOptions = {}): AsyncGenerator<string> {
   }
 }
 
-type Entry = { name: string; isDirectory: boolean };
+async function isDirLink(path: string): Promise<boolean> {
+  try {
+    return (await statFs(path)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+type Entry = { name: string; isDirectory: boolean; isLink: boolean };
 
 /** Resolves a model-supplied path inside the workspace, rejecting escapes. */
 export function jail(p: string, root = process.cwd()): string {