OMNIS-31: Add the TUI skeleton and module browser

[JtheGunner]

YouTrack: https://youtrack.xn--wrm-hoa.li/issue/OMNIS-31 (sub-task of OMNIS-14)

Adds omnishell tui: a full-screen, read-only module browser (module list, detail pane with description, homepage, package status, platforms and shells, and a / filter). It reads modules through modedit.Views and never writes any file.

Changes

• internal/tui: Bubble Tea v2 model (Update is a pure function of model and message), layout, Run, and a one-method Backend interface. It imports neither internal/cli nor internal/engine.
• internal/cli/tui.go: the tui command. It exits 2 before taking over the screen when stdin or stdout is not a terminal, or when config.toml is missing or malformed.
• Below 80x20 the browser is replaced by a "terminal too small" line.
• Module text from manifests is stripped of control characters and bidi overrides before it is drawn, so a user-supplied manifest cannot inject terminal escape sequences.
• README, CHANGELOG and CLAUDE.md document the command; design spec and implementation plan are under docs/superpowers.

Dependencies

• New: charm.land/bubbletea/v2 v2.0.10, charm.land/lipgloss/v2 v2.0.6, github.com/charmbracelet/x/ansi v0.11.8 and github.com/charmbracelet/x/term v0.2.2, plus their transitive modules. These are the first runtime dependencies besides cobra and toml.
• The go directive moves from 1.26 to 1.26.0, which Bubble Tea v2.0.10 requires. CI reads it from go.mod.
• Binary size (stripped, -s -w): 10,398,610 bytes on main, 11,982,258 bytes here (+1,583,648 bytes, about +1.5 MiB, +15%).
• No teatest: it has no tagged release. Rendering is tested with plain-text golden files of View().Content plus structural assertions, and one real-program smoke test.

Commits

• docs: add implementation plan for the TUI skeleton and browser (OMNIS-31)
• feat: add the module browser model to the tui package
• feat: render the module browser layout with golden snapshots
• feat: add the omnishell tui command with terminal and config guards
• fix: neutralise control characters in module text before rendering
• docs: document the omnishell tui command

Test plan

• make vet and make test (race detector) pass locally.
• govulncheck ./... reports no vulnerabilities.
• CGO_ENABLED=0 go build ./cmd/omnishell succeeds for linux/amd64, linux/arm64, linux/armv6, linux/armv7, darwin/amd64 and darwin/arm64.
• omnishell tui < /dev/null exits 2 with "needs an interactive terminal".
• CI: vet, race tests, golangci-lint, govulncheck and the build matrix pass.
• Reviewer: run omnishell init, then omnishell tui in a real terminal. Check the list, the detail pane, / filtering (enter keeps, esc clears), resizing below 80x20 and back, and q/Ctrl-C leaving the terminal clean.

Known gaps (tracked for later sub-tasks)

• Modules that cannot run on this host are not dimmed yet (OMNIS-32 needs a host-compatibility field in modedit).
• omnishell list still prints manifest text unsanitised; this predates the change.