Add TUI for managing sandbox profile, relicense to GPLv3

- Add Go/Bubble Tea TUI app under tui/ with dashboard (status checks,
  launch, validate) and profile editor (commands, filesystem, network,
  environment sub-tabs)
- Add Makefile targets: tui, tui-build, tui-install
- Add CI step to build TUI
- Relicense MIT -> GPL-3.0
- Rewrite wrapper to resolve real opencode binary from PATH (supports
  brew, npm, volta)
- Add PATH ordering detection to install script
- Expand README with how-it-works diagram, TUI docs, keybinding table

profiles/opencode-tinfoil.jsonc

@@ -47,13 +47,13 @@
       "."
     ],
     "read": [
-      "${HOME}/.config/opencode",
-      "${HOME}/.local/share/opencode",
-      "${HOME}/.opencode",
-      "${HOME}/.claude",
-      "${HOME}/.gitconfig",
-      "${HOME}/.ssh/config",
-      "${HOME}/.tinfoil",
+      "$HOME/.config/opencode",
+      "$HOME/.local/share/opencode",
+      "$HOME/.opencode",
+      "$HOME/.claude",
+      "$HOME/.gitconfig",
+      "$HOME/.ssh/config",
+      "$HOME/.tinfoil",
       "/etc/ssl",
       "/etc/pki",
       "/usr/share/ca-certificates",
@@ -61,22 +61,22 @@
       "/tmp"
     ],
     "write": [
-      "${HOME}/.config/opencode",
-      "${HOME}/.local/share/opencode",
-      "${HOME}/.opencode",
-      "${HOME}/.claude",
+      "$HOME/.config/opencode",
+      "$HOME/.local/share/opencode",
+      "$HOME/.opencode",
+      "$HOME/.claude",
       "/tmp"
     ],
     "deny": [
-      "${HOME}/.ssh/id_*",
-      "${HOME}/.gnupg",
-      "${HOME}/.aws",
-      "${HOME}/.azure",
-      "${HOME}/.gcp",
-      "${HOME}/.kube",
-      "${HOME}/.docker/config.json",
-      "${HOME}/.netrc",
-      "${HOME}/.npmrc",
+      "$HOME/.ssh/id_*",
+      "$HOME/.gnupg",
+      "$HOME/.aws",
+      "$HOME/.azure",
+      "$HOME/.gcp",
+      "$HOME/.kube",
+      "$HOME/.docker/config.json",
+      "$HOME/.netrc",
+      "$HOME/.npmrc",
       "/etc/shadow",
       "/etc/passwd",
       "/etc/hosts"
@@ -134,8 +134,8 @@
   },
   "environment": {
     "set_vars": {
-      "OPENCODE_CONFIG_DIR": "${HOME}/.config/opencode",
-      "TINFOIL_CONFIG_DIR": "${HOME}/.tinfoil"
+      "OPENCODE_CONFIG_DIR": "$HOME/.config/opencode",
+      "TINFOIL_CONFIG_DIR": "$HOME/.tinfoil"
     },
     "deny_vars": [
       "AWS_SECRET_ACCESS_KEY",