Add TUI for managing sandbox profile, relicense to GPLv3

- Add Go/Bubble Tea TUI app under tui/ with dashboard (status checks,
  launch, validate) and profile editor (commands, filesystem, network,
  environment sub-tabs)
- Add Makefile targets: tui, tui-build, tui-install
- Add CI step to build TUI
- Relicense MIT -> GPL-3.0
- Rewrite wrapper to resolve real opencode binary from PATH (supports
  brew, npm, volta)
- Add PATH ordering detection to install script
- Expand README with how-it-works diagram, TUI docs, keybinding table

scripts/install.sh

@@ -33,9 +33,45 @@ echo "Installed:"
 echo "  Profile: ${PROFILE_DIR}/${PROFILE_NAME}.json"
 echo "  Wrapper: ${BIN_DIR}/opencode"
 
+find_first_opencode() {
+  local d c
+  for d in $(printf '%s' "$PATH" | tr ':' ' '); do
+    for c in "$d/opencode" "$d/opencode.exe"; do
+      if [ -x "$c" ]; then
+        printf '%s\n' "$c"
+        return 0
+      fi
+    done
+  done
+  return 1
+}
+
+WRAPPER_OK=0
+if [[ "$(find_first_opencode)" == "${BIN_DIR}/opencode" ]]; then
+  WRAPPER_OK=1
+fi
+
+if [[ "${WRAPPER_OK}" -ne 1 ]]; then
+  echo ""
+  echo "Warning: 'opencode' on your PATH resolves to a different binary."
+  echo "The sandboxed wrapper at ${BIN_DIR}/opencode will be bypassed."
+  echo "Fix this with one of:"
+  echo "  export PATH=\"${BIN_DIR}:\${PATH}\""
+  echo "  alias opencode='${BIN_DIR}/opencode'"
+fi
+
 if [[ ":${PATH}:" != *":${BIN_DIR}:"* ]]; then
   echo ""
   echo "Warning: ${BIN_DIR} is not in your PATH."
   echo "Add this to your shell profile:"
   echo "  export PATH=\"${BIN_DIR}:\${PATH}\""
+fi
+
+echo ""
+echo "Smoke test (this launches opencode inside the sandbox):"
+if "${BIN_DIR}/opencode" --version; then
+  echo "OK: sandboxed wrapper launches successfully."
+else
+  echo "Error: sandboxed wrapper failed to launch." >&2
+  exit 1
 fi