v0.8.3: TUI stabilization — box calls, package fixes, sandbox, configure

Bug fixes:
- Fix box() calls: set color-pair before box, pass ACS default chtype integers
- Fix markdown functions: move to passepartout.channel-tui package where
  Croatoan is imported; use add-attributes/remove-attributes instead of
  :bold/:underline kwargs to add-string; call theme-color in gate-trace-lines
  to convert theme keys to Croatoan colors
- Fix sandbox: remove dex:get/dex:post from restricted symbols
  (blocked neuro-provider from loading)
- Export *log-lock* from passepartout (was unbound in jailed skill packages)
- Fix configure: always deploy to XDG, skip cp when source==dest
- Fix bash crash handler format string (~~ escaping)
- Revert test reorder in 28 files (caused package leakage in skill loader)

Design cleanup:
- Extract tui-run-screen from tui-main for clean separation
- Remove inject-stimulus alias
- Merge *backend-registry* into *probabilistic-backends*
- Fix read-framed-message whitespace DoS (4096-iteration max)
- Add *read-eval* nil to dispatcher-approvals-process read-from-string

org/security-permissions.org

@@ -25,39 +25,6 @@ consults this table as one of its ten scan vectors.
 - Does NOT persist permissions to disk — this is runtime-only.
 - Does NOT validate that ~level~ is one of ~(:allow :ask :deny)~.
 
-* Test Suite
-
-#+begin_src lisp
-(eval-when (:compile-toplevel :load-toplevel :execute)
-  (ql:quickload :fiveam :silent t))
-
-(defpackage :passepartout-security-permissions-tests
-  (:use :cl :fiveam :passepartout)
-  (:export #:permissions-suite))
-
-(in-package :passepartout-security-permissions-tests)
-
-(def-suite permissions-suite :description "Verification of Tool Permissions")
-(in-suite permissions-suite)
-
-(test test-permission-round-trip
-  "Contract 1: permission-set stores a level; permission-get retrieves it."
-  (permission-set "test-tool" :allow)
-  (is (eq :allow (permission-get "test-tool")))
-  ;; Clean up
-  (permission-set "test-tool" nil))
-
-(test test-permission-default
-  "Contract 2: unregistered tools default to :ask."
-  (is (eq :ask (permission-get "never-registered-tool-xyz"))))
-
-(test test-permission-case-insensitive
-  "Contract 3: tool names are normalized to lowercase."
-  (permission-set :CapitalTool :deny)
-  (is (eq :deny (permission-get :capitaltool)))
-  (permission-set "CapitalTool" nil))
-#+end_src
-
 * Implementation
 
 ** Package Context
@@ -97,3 +64,35 @@ Retrieves the current permission level for a tool. Defaults to ~:ask~ if unset.
   :trigger (lambda (ctx) (declare (ignore ctx)) nil))
 #+end_src
 
+* Test Suite
+
+#+begin_src lisp
+(eval-when (:compile-toplevel :load-toplevel :execute)
+  (ql:quickload :fiveam :silent t))
+
+(defpackage :passepartout-security-permissions-tests
+  (:use :cl :fiveam :passepartout)
+  (:export #:permissions-suite))
+
+(in-package :passepartout-security-permissions-tests)
+
+(def-suite permissions-suite :description "Verification of Tool Permissions")
+(in-suite permissions-suite)
+
+(test test-permission-round-trip
+  "Contract 1: permission-set stores a level; permission-get retrieves it."
+  (permission-set "test-tool" :allow)
+  (is (eq :allow (permission-get "test-tool")))
+  ;; Clean up
+  (permission-set "test-tool" nil))
+
+(test test-permission-default
+  "Contract 2: unregistered tools default to :ask."
+  (is (eq :ask (permission-get "never-registered-tool-xyz"))))
+
+(test test-permission-case-insensitive
+  "Contract 3: tool names are normalized to lowercase."
+  (permission-set :CapitalTool :deny)
+  (is (eq :deny (permission-get :capitaltool)))
+  (permission-set "CapitalTool" nil))
+#+end_src