Add batch reads, @file completion, interruptible commands, tool sets

Tools, six built-in to fourteen:
- read_many_files: up to 20 paths read concurrently, each with its own window.
  An unreadable path is reported in its own block instead of throwing.
- multi_edit: several edits to one file, validated in memory first so a late
  failure cannot leave the file half-written.
- list_dir: ignore-aware depth-limited tree.
- git_status/diff/log/show/blame: read-only, spawned with a fixed argv rather
  than a shell string, which is what makes them safe to auto-approve.

toolSets gates them. core is always on; edit-plus and git are optional. A
disabled set reaches neither the wire nor the system prompt, since a prompt
naming an absent tool teaches calls that cannot succeed.

Interface:
- Reasoning streams to a collapsed panel, ctrl-r expands, dropped when the turn
  ends: it is progress, not the answer.
- The tool in flight is named from tool-input-start, before its arguments finish
  streaming, and cleared on its result.
- Prompts typed mid-turn queue and drain in order. esc clears the queue as well
  as aborting.
- @ opens a path picker fed by the ignore-aware walker. Prefix matches rank
  above substring matches, so @src/ means "under src/". The walk runs on the
  first @, not at startup.

ctrl-c kills the command in flight and keeps the turn. The call throws rather
than returning, so the model cannot read a killed command as one that ran and
failed on its own terms. The kill takes the whole process tree: killing cmd /c
alone left the real command holding both pipes open, so the read never returned
and the interrupt did nothing for 19 seconds.

Two pruning fixes:
- A tool result whose tool call was pruned is now dropped with it. Pruning
  counts messages, so the cut landed between an assistant tool-call and the tool
  message answering it, producing 400 "No tool call found for function call
  output with call_id ...". The reverse pairing is left alone: a call awaiting
  its result is what a suspended approval looks like.
- ignore.ts called statFs without importing it, so walk() crashed on the first
  symlink.

482 tests, up from 404. Docs synced across README, ROADMAP, TODO, and all of
docs/: tool sets, the new tools, ctrl-c semantics, the tool-start event, and the
two hand-maintained tool-name lists recorded as a known weakness.

src/ui/PromptInput.tsx

@@ -3,7 +3,8 @@ import React, { useEffect, useState } from 'react';
 
 export type PromptInputProps = {
   value: string;
-  onChange: (value: string) => void;
+  /** Cursor is reported alongside the value: `@path` completion needs to know where it is. */
+  onChange: (value: string, cursor: number) => void;
   onSubmit: (value: string) => void;
   placeholder?: string;
   focus?: boolean;
@@ -12,6 +13,8 @@ export type PromptInputProps = {
   history?: readonly string[];
   /** Intercept a key before the input consumes it. Return true to swallow it. */
   onKey?: (input: string, key: KeyLike) => boolean;
+  /** Where to put the cursor on mount, for a remounted input after a completion. */
+  initialCursor?: number;
 };
 
 type KeyLike = {
@@ -51,8 +54,9 @@ export function PromptInput({
   mask,
   history = [],
   onKey,
+  initialCursor,
 }: PromptInputProps) {
-  const [cursor, setCursor] = useState(value.length);
+  const [cursor, setCursor] = useState(initialCursor ?? value.length);
   // -1 means "editing a fresh line"; 0+ indexes back from the newest entry.
   const [recall, setRecall] = useState(-1);
   const [stash, setStash] = useState('');
@@ -62,8 +66,9 @@ export function PromptInput({
   }, [value]);
 
   const set = (next: string, nextCursor = next.length) => {
-    onChange(next);
-    setCursor(Math.max(0, Math.min(nextCursor, next.length)));
+    const clamped = Math.max(0, Math.min(nextCursor, next.length));
+    onChange(next, clamped);
+    setCursor(clamped);
   };
 
   useInput(