Add TUI for managing sandbox profile, relicense to GPLv3

- Add Go/Bubble Tea TUI app under tui/ with dashboard (status checks,
  launch, validate) and profile editor (commands, filesystem, network,
  environment sub-tabs)
- Add Makefile targets: tui, tui-build, tui-install
- Add CI step to build TUI
- Relicense MIT -> GPL-3.0
- Rewrite wrapper to resolve real opencode binary from PATH (supports
  brew, npm, volta)
- Add PATH ordering detection to install script
- Expand README with how-it-works diagram, TUI docs, keybinding table

Makefile

@@ -1,8 +1,9 @@
 PREFIX ?= $(HOME)/.local
 PROFILE_DIR = $(HOME)/.config/nono/profiles
 BIN_DIR = $(PREFIX)/bin
+TUI_DIR = tui
 
-.PHONY: install uninstall validate test
+.PHONY: install uninstall validate test tui tui-build tui-install
 
 install:
 	@./scripts/install.sh
@@ -16,4 +17,13 @@ validate:
 	nono profile validate opencode-tinfoil
 
 test:
-	nono run --profile opencode-tinfoil --allow-cwd -- opencode --version
+	$(BIN_DIR)/opencode --version
+
+tui:
+	cd $(TUI_DIR) && go run .
+
+tui-build:
+	cd $(TUI_DIR) && go build -buildvcs=false -o $(BIN_DIR)/nono-tui .
+
+tui-install: tui-build
+	@echo "Installed nono-tui to $(BIN_DIR)/nono-tui"