feat(coding): add workspace coding sessions

[XiaoConstantine]

Summary

• route natural-language TUI input to a Tau/Pi-style workspace coding session while keeping /ask as read-only QA
• delegate execution to dspy-go v0.86 native.Agent.ExecuteWithTrace; no second agent loop
• register rooted ls, read, write, and edit tools, with unrestricted bash disabled unless --allow-coding-bash is explicitly set
• map typed run/turn/tool events into TUI progress and support Escape cancellation
• persist coding history under isolated internal session IDs and account from operation-scoped canonical traces
• add a maestro-probe --strategy coding smoke-test path and user/architecture documentation

Safety and lifecycle

• overlapping runs are rejected and rejected input remains editable
• cancellation is reserved synchronously, including Escape before the backend command starts
• session close is terminal and replacement invalidates closed cache entries
• shutdown rejects new coding work, quiesces coding before deleting the cloned workspace or closing SQLite, and preserves independent ACE cleanup
• partial/max-turn runs remain visible stopped results instead of being reclassified as failures
• internal coding sessions are hidden from and rejected by user-facing session operations

Battle test

A live Gemini coding probe against a temporary repository successfully created hello.txt with the exact requested contents. Its operation-scoped trace recorded one coding.native call and non-zero token usage.

Verification

• go test ./...
• go test -race ./...
• go vet ./...
• golangci-lint run --new-from-rev=4c43e33 ./...
• go mod tidy -diff
• git diff --check
• repeated independent Codex review; final verdict clean

Stack

This PR is based on #107, which upgrades Maestro to dspy-go v0.86.0.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.