v0.8.3: TUI stabilization — box calls, package fixes, sandbox, configure

Bug fixes:
- Fix box() calls: set color-pair before box, pass ACS default chtype integers
- Fix markdown functions: move to passepartout.channel-tui package where
  Croatoan is imported; use add-attributes/remove-attributes instead of
  :bold/:underline kwargs to add-string; call theme-color in gate-trace-lines
  to convert theme keys to Croatoan colors
- Fix sandbox: remove dex:get/dex:post from restricted symbols
  (blocked neuro-provider from loading)
- Export *log-lock* from passepartout (was unbound in jailed skill packages)
- Fix configure: always deploy to XDG, skip cp when source==dest
- Fix bash crash handler format string (~~ escaping)
- Revert test reorder in 28 files (caused package leakage in skill loader)

Design cleanup:
- Extract tui-run-screen from tui-main for clean separation
- Remove inject-stimulus alias
- Merge *backend-registry* into *probabilistic-backends*
- Fix read-framed-message whitespace DoS (4096-iteration max)
- Add *read-eval* nil to dispatcher-approvals-process read-from-string

org/channel-shell.org

@@ -26,41 +26,6 @@ Because shell execution is the highest-risk operation in the system, the Shell A
    command through the sandbox. When ~bwrap~ is unavailable, falls back to the
    existing ~timeout bash -c~ behavior.
 
-* Test Suite
-#+begin_src lisp
-(eval-when (:compile-toplevel :load-toplevel :execute)
-  (ql:quickload :fiveam :silent t))
-
-(defpackage :passepartout-shell-actuator-tests
-  (:use :cl :fiveam :passepartout)
-  (:export #:shell-actuator-suite))
-
-(in-package :passepartout-shell-actuator-tests)
-
-(def-suite shell-actuator-suite :description "Verification of the Shell Actuator")
-(in-suite shell-actuator-suite)
-
-(test test-bwrap-wrap-command
-  "Contract 2: bwrap-wrap-command returns properly formatted command list."
-  (let ((cmdline (passepartout::bwrap-wrap-command "echo hello" 30 "/home/user/memex")))
-    (is (member "bwrap" cmdline :test #'string=))
-    (is (member "--unshare-net" cmdline :test #'string=))
-    (is (member "--unshare-ipc" cmdline :test #'string=))
-    (is (member "echo hello" cmdline :test #'string=))))
-
-(test test-bwrap-available-p-returns-boolean
-  "Contract 1: bwrap-available-p returns T or NIL."
-  (let ((avail (passepartout::bwrap-available-p)))
-    (is (typep avail 'boolean))))
-
-(test test-actuator-shell-execute-echo
-  "Contract 3: actuator-shell-execute runs echo and returns output."
-  (let* ((action '(:type :REQUEST :target :shell :payload (:cmd "echo hello")))
-         (result (passepartout::actuator-shell-execute action nil)))
-    (is (stringp result))
-    (is (search "hello" result :test #'char-equal))))
-#+end_src
-
 * Implementation
 
 ** Shell Execution (actuator-shell-execute)
@@ -134,3 +99,37 @@ When bwrap is available, wraps the command in a Linux namespace sandbox."
   :trigger (lambda (ctx) (declare (ignore ctx)) nil))
 #+end_src
 
+* Test Suite
+#+begin_src lisp
+(eval-when (:compile-toplevel :load-toplevel :execute)
+  (ql:quickload :fiveam :silent t))
+
+(defpackage :passepartout-shell-actuator-tests
+  (:use :cl :fiveam :passepartout)
+  (:export #:shell-actuator-suite))
+
+(in-package :passepartout-shell-actuator-tests)
+
+(def-suite shell-actuator-suite :description "Verification of the Shell Actuator")
+(in-suite shell-actuator-suite)
+
+(test test-bwrap-wrap-command
+  "Contract 2: bwrap-wrap-command returns properly formatted command list."
+  (let ((cmdline (passepartout::bwrap-wrap-command "echo hello" 30 "/home/user/memex")))
+    (is (member "bwrap" cmdline :test #'string=))
+    (is (member "--unshare-net" cmdline :test #'string=))
+    (is (member "--unshare-ipc" cmdline :test #'string=))
+    (is (member "echo hello" cmdline :test #'string=))))
+
+(test test-bwrap-available-p-returns-boolean
+  "Contract 1: bwrap-available-p returns T or NIL."
+  (let ((avail (passepartout::bwrap-available-p)))
+    (is (typep avail 'boolean))))
+
+(test test-actuator-shell-execute-echo
+  "Contract 3: actuator-shell-execute runs echo and returns output."
+  (let* ((action '(:type :REQUEST :target :shell :payload (:cmd "echo hello")))
+         (result (passepartout::actuator-shell-execute action nil)))
+    (is (stringp result))
+    (is (search "hello" result :test #'char-equal))))
+#+end_src