feat: lest ui --app, README with screenshots per feature

[piekstra]

Summary

• lest ui --app opens the UI in its own window: a Chromium-family browser (Chrome, Chromium, Edge, Brave) in app mode with a dedicated profile under the data directory. Falls back to the default browser when none is installed. docs/design.md now records that there is no desktop shell and why.
• Settings: leaving the page within the 600 ms save pause dropped a text edit. The pending edit is now saved on unmount.
• Failure card: the agent handoff is refetched when the agent command changes, so Open in agent appears without a reload.
• README rewritten with an example and a screenshot per feature: flows and polling, failure headlines, browsers and live view, demos (with a GIF of the real cut), the UI, optional AI, and CI.
• All docs screenshots regenerated from the examples project; the screenshot script sets an agent command for the AI images.

Evidence

Captured with ui/scripts/screenshots.mjs against lest ui serving a copy of examples/, headless Chromium at 1440x900, 2x. The AI images use a custom command provider that pipes the prompt to a small model.

A failed step explained by a model, Open in agent in the menu (this needed the handoff fix):

AI settings with an agent command:

The demo cut from connect-weather (11 s from a 14 s take):

The Settings flush was checked with a Playwright script that types an agent command and navigates away immediately; the settings API then returned the new value.

Checks

• make check passes (fmt, clippy, 77 Rust tests, 37 UI tests, release build).
• Denylist scan clean; every image reviewed by eye.

[piekstra]

Review dispositions (fixed in f1ec935 unless noted):

• Linux --app browser shared the terminal's process group, so Ctrl-C closed every app window: fixed, the browser starts in its own process group.
• A browser that exits at once was reported as opened: fixed, an early non-zero exit falls back to a tab; an early zero exit (handed to a running browser) counts as opened.
• Unreaped child: fixed, a thread waits on it.
• macOS only checked /Applications: fixed, ~/Applications too. The fallback message now covers both "none found" and "failed to start".
• Settings unmount save swallows errors and does not run when the window closes: kept. The comment now says it covers in-app navigation; a failed save there has no page left to show it on.
• Handoff kept the old command while reloading: fixed, cleared on refetch.
• design.md "UI" twice and an over-long line: fixed.
• docs/ui.md did not mention --app: fixed.
• Screenshot script poll had no timeout: fixed, fails after about 10 s.

The Linux --app path is checked by build and clippy only; CI has no display to open a window in.