Fix review scoping, TUI markdown, slash args, and patch regressions

[congjiujiu]

Resolved issues

Resolves #51
Resolves #52
Resolves #53
Resolves #54

Details

#51 Scope PR review file tools to repo root

• Added ProjectRoot plumbing through engine creation, CLI run/workflow/team paths, TUI session refresh/switching, and spawned subagents.
• Scoped read, glob, grep, and ls so default and relative paths resolve under the detected project root.
• Rejects unsafe traversal roots such as home, /Users, /, and common macOS protected folders.
• Skips protected/noisy directories during recursive traversal, including .git, node_modules, vendor, .cache, Library, Desktop, Documents, Downloads, Music, Pictures, Movies, Photos, and Library/Mobile Documents.
• Tightened grep exclusions so nested protected directories like src/Documents are excluded too.
• Added symlink-aware path checks so scoped reads cannot escape the project root through symlinks.
• Added /review <GitHub PR URL> handling that prepares a dedicated checkout and re-scopes file tools to that checkout root before review.

#52 Render markdown in assistant messages

• Ensures assistant messages are rendered through the existing markdown renderer once terminal dimensions are known.
• Resets the render cache when the markdown renderer is created or resized so old plain-rendered messages get re-rendered.
• Added regression coverage for I'm **altcode** while preserving literal markdown inside fenced code blocks.

#53 altcode review on altcode findings

• Added a timeout-backed patch command context and patch --batch so system patch cannot hang indefinitely.
• Added strict patch validation for malformed hunk headers before invoking system patch.
• Fixed patch tests to check setup/read errors instead of ignoring them.
• Adjusted steer draining to briefly wait for near-boundary user guidance before implement/review prompts are built.

#54 Preserve original prompt after evaluate finishes

• Fixed skill slash-command expansion so project skills such as /evaluate <prompt> keep user arguments even when SKILL.md does not include $ARGUMENTS.
• Appends the original user request under User request: for skill commands without explicit argument placeholders.

Tests

• make build
• GOFLAGS=-mod=mod go build ./...
• GOFLAGS=-mod=mod go vet ./...
• GOFLAGS=-mod=mod go test ./... -race -count=1 -timeout=180s