Add TUI for managing sandbox profile, relicense to GPLv3

- Add Go/Bubble Tea TUI app under tui/ with dashboard (status checks,
  launch, validate) and profile editor (commands, filesystem, network,
  environment sub-tabs)
- Add Makefile targets: tui, tui-build, tui-install
- Add CI step to build TUI
- Relicense MIT -> GPL-3.0
- Rewrite wrapper to resolve real opencode binary from PATH (supports
  brew, npm, volta)
- Add PATH ordering detection to install script
- Expand README with how-it-works diagram, TUI docs, keybinding table

tui/main.go

@@ -0,0 +1,32 @@
+package main
+
+import (
+	"fmt"
+	"os/exec"
+	"strings"
+
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+func saveAndValidateCmd(path string, p *Profile) tea.Cmd {
+	return func() tea.Msg {
+		if err := SaveProfile(path, p); err != nil {
+			return saveResultMsg{err: err}
+		}
+		cmd := exec.Command("nono", "profile", "validate", "opencode-tinfoil")
+		out, err := cmd.CombinedOutput()
+		output := strings.TrimSpace(string(out))
+		if err != nil {
+			return saveResultMsg{output: output, err: fmt.Errorf("validation failed")}
+		}
+		return saveResultMsg{output: output}
+	}
+}
+
+func main() {
+	m, _ := NewModel()
+	p := tea.NewProgram(m, tea.WithAltScreen())
+	if _, err := p.Run(); err != nil {
+		fmt.Printf("Error: %v\n", err)
+	}
+}