Add TUI for managing sandbox profile, relicense to GPLv3

- Add Go/Bubble Tea TUI app under tui/ with dashboard (status checks,
  launch, validate) and profile editor (commands, filesystem, network,
  environment sub-tabs)
- Add Makefile targets: tui, tui-build, tui-install
- Add CI step to build TUI
- Relicense MIT -> GPL-3.0
- Rewrite wrapper to resolve real opencode binary from PATH (supports
  brew, npm, volta)
- Add PATH ordering detection to install script
- Expand README with how-it-works diagram, TUI docs, keybinding table

bin/opencode

@@ -1,4 +1,23 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-exec nono run --profile opencode-tinfoil --allow-cwd -- opencode "$@"
+find_real_opencode() {
+  local d c
+  for d in $(printf '%s' "$PATH" | tr ':' ' '); do
+    for c in "$d/opencode" "$d/opencode.exe"; do
+      if [ -x "$c" ] && [ "$c" != "$HOME/.local/bin/opencode" ]; then
+        printf '%s\n' "$c"
+        return 0
+      fi
+    done
+  done
+  return 1
+}
+
+REAL_OPENCODE="$(find_real_opencode || true)"
+if [ -z "$REAL_OPENCODE" ]; then
+  echo "Error: real opencode binary not found in PATH" >&2
+  exit 1
+fi
+
+exec nono run --profile opencode-tinfoil --allow-cwd -- "$REAL_OPENCODE" "$@"