feat(guardrails): steering channel + shell-in-file rule + capability-gap detector

Bundles three operator-reliability guardrails (Vikunja #28/#29/#30) plus the
in-flight branch WIP they were built on top of (reasoning_content capture,
operator/project profile editor, write-jail workspaceRoot fix) — the tree is
interdependent (SessionOrchestrator references reasoningArtifactId from the WIP)
and does not compile as separable subsets, so it lands as one commit.

Guardrails:
- #28 mid-stage steering: ClientMessage.SteerSession -> GlobalStreamHandler ->
  orchestrator.submitSteering, reusing SteeringNoteAddedEvent + existing context
  fold (advisory, non-authoritative; invariants #3/#7). Closes the gap where
  steering typed off an approval gate was silently dropped.
- #29 shell-in-file guardrail: ShellInFileContentRule (core:toolintent) blocks a
  file_write whose content is a bare shell command (e.g. "mkdir -p ..."); FileWriteTool
  description now advertises auto-mkdir of parent dirs. Basename-allowlist so the
  extensionless case is caught; scripts/Makefiles/multiline exempt.
- #30 pt1 capability-gap detector: deterministic CapabilityGapDetector maps stage
  intent -> implied ToolCapability, compares to granted tools, emits advisory
  CapabilityGapDetectedEvent in FreestyleDriver.lockAndRun. Recorded, never fails
  the gate and never auto-grants (invariants #3/#4/#5). Reflection rung is pt2.

Verified: ./gradlew check green (whole tree).

apps/tui-go/internal/app/view.go

@@ -182,7 +182,11 @@ func (m Model) renderStatus() string {
 	if s := m.session(m.selectedID); s != nil && m.displayState() != StateIdle {
 		parts = append(parts, span(s.Name, t.P.FgStrong))
 		if s.CurrentStage != "" && m.sbShow("stage") {
-			parts = append(parts, span("⟐ "+s.CurrentStage, t.P.Accent2))
+			stageLabel := "⟐ " + s.CurrentStage
+			if budget, ok := s.TokenBudgetByStage[s.CurrentStage]; ok && budget > 0 {
+				stageLabel += fmt.Sprintf(" (%d/%d)", s.StageTokensUsed, budget)
+			}
+			parts = append(parts, span(stageLabel, t.P.Accent2))
 		}
 		if s.Status != "" && m.sbShow("status") {
 			parts = append(parts, lipgloss.NewStyle().Foreground(statusColor(t, s.Status)).Background(bg).Render(statusLabel(s.Status)))