Modal shell for Rex apps

- wait-pr (visit 1): pass, then pr-green: held after 26 checks
- pr-green (visit 1): pass, then signoff: exit 0
- signoff (visit 1): pass, then rebase: approved by rule autonomous
- rebase (visit 1): pass, then wait-rebased: exit 0
- wait-rebased (visit 1): pass, then rebased-green: held after 25 checks
- rebased-green (visit 1): pass, then land: exit 0
- land (visit 1): pass, then wait-landed: exit 0
- wait-landed (visit 1): pass, then landed-green: held after 22 checks
- landed-green (visit 1): pass, then rebase-merge: exit 0
- rebase-merge (visit 1): pass, then wait-rebased-merge: exit 0
- wait-rebased-merge (visit 1): pass, then rebased-merge-green: held after 1 checks
- rebased-merge-green (visit 1): pass, then merge: exit 0
- merge (visit 1): pass, then wait-main: exit 0
- wait-main (visit 1): pass, then main-green: held after 1 checks
- main-green (visit 1): pass, then close-out: exit 0
- close-out (visit 1): pass, then ship: exit 0
- ship (visit 1): pass, then end: exit 0

## Leaves

- modal-shell-hosts-component (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session 39b7687c-1c2e-4045-b0b8-01a1aa50afd9: pass (said done)
  - attempt 1 verifier, session 81472132-1743-4a69-b127-01a1aa520f82: pass (Evidence written by the verifier)
- modal-shell-closes (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session 0915fd18-4681-468a-b6e2-01a1aa5230f9: pass (said done)
  - attempt 1 verifier, session b741bd1b-5162-4689-8228-01a1aa52d11a: pass (Evidence written by the verifier)
- modal-sized-to-content (step build/build): passed: attempt 2: verifier passed
  - attempt 1 builder, session 609f34b7-acb9-4c4a-90ce-01a1aa52f843: pass (said done)
  - attempt 1 verifier, session 325b7cc8-f93e-4282-80ca-01a1aa53fc91: fail (verifier found 2 problem(s))
  - attempt 2 builder, session b0eff1ec-fafe-40c8-b205-01a1aa5531df: pass (said done)
  - attempt 2 verifier, session 911c09c8-34b2-4ffc-9db3-01a1aa61b3b4: pass (Evidence written by the verifier)
  - attempt 1 finding f1: Acceptance asks that each app's action open a layer sized to the cells of the app's component NaturalSize. At df2245ea, nothing links a size to NaturalSize. TestRexInstallOpensEveryAppAsACentredModalNotFullScreen (internal/api/rex_install_test.go) compares the Lua against launcher.App.Size(), the registry's static Cols/Rows. No real app sets those (grep launcher.Register: every registration leaves Cols/Rows zero), so every action gets the default 100x30. The only NaturalSize in the tree is modalshell.Shell/Component (internal/tui/modalshell/modalshell.go:37,59,123). No app registers through it: cmd/rhiza/tui.go calls modalshell.Run(m) on raw models, and no app type defines NaturalSize. An app whose component's NaturalSize changed would still open at 100x30 and the test would still pass. Ran: go test -trimpath ./internal/api -run TestRexInstall -count=1 (ok); grep -rn NaturalSize --include=*.go internal cmd.
  - attempt 1 finding f2: The centring check in TestRexInstallOpensEveryAppAsACentredModalNotFullScreen calls surface.BoundsForCells(wc, cols, rows, surface.Centered) in Go and asserts that the library's own result is centred and smaller than the window. It never checks the bounds that the written rhiza.lua's cell_bounds produces, so it does not show the action places the layer as BoundsForCells places a Modal. A change to the Lua's fit_axis (for example pos = 0) would still pass. The testscript's additions (! grep LAYER_BOUNDS / ! grep cell_bounds(ctx.block_id, 0) still pass, ran go test -trimpath ./cmd/rhiza -run TestScripts/rex-install -count=1) only grep the literal 100, 30 call. They do not check sizes taken from each component's NaturalSize.
- modal-sized-to-content (step review/review): open
  - attempt 2 fixer in cycle 2, session 801e6f0b-7dfc-4d81-837c-01a1aa6d6f8e: pass (said done)
  - attempt 2 verifier in cycle 2, session 2a05f8b0-4210-4499-9b97-01a1aa76412e: pass (Evidence written by the verifier)

## Checks

- compliance (step review/review): passed after 1 cycle
  - cycle 1: passed, check session 4f420ee8-640c-4b31-8b6e-01a1aa634af1 pass (said done)
  - round 1 (cycle 1): 2 findings, 0 confirmed
    - f1 minor at cmd/rhiza/tui.go:189 on modal-shell-hosts-component: Acceptance is met as written, but the statement says rhiza tui app runs every app through the shell: apps go through modalshell.Run, which only wraps the old tea.Model in surface/program; none is hosted by a Shell around a rexuikit component yet (left to the per-app change sets).
    - f2 nit at internal/tui/modalshell/modalshell_test.go:91 on modal-shell-hosts-component: TestRendersComponent checks the view contains a label, not that it equals the component's own Render(); an equality check would pin 'the view carries the component's own render' more tightly.
- quality (step review/review): passed after 1 cycle
  - cycle 1: passed, check session 2ae8b587-7694-4978-9941-01a1aa636b28 pass (said done)
  - round 1 (cycle 1): 4 findings, 0 confirmed
    - f1 minor at internal/tui/modalshell/modalshell.go:100 on modal-shell-closes: Shell, Shell.Run and its Result are not used in production: cmd/rhiza/tui.go calls only the package-level modalshell.Run(m), which discards any result, and no registered app sets launcher.App.Component. So the result 'handed back for --once' reaches no caller yet. The shell's behaviour is tested only in isolation.
    - f2 nit at internal/tui/modalshell/modalshell.go:78 on modal-shell-closes: The shell catches esc before the component sees it, so ui.Form never sets its status to FormCancelled. A component that will later use esc for something of its own (closing a Select's options, clearing a List query) cannot, because the shell quits first. The components already turn esc into their own cancel messages, which the shell handles, so forwarding esc to the component first would give the same close without these side effects.
    - f3 nit at internal/api/rex_modal_test.go:141 on modal-sized-to-content: The test registers zz-modal-* apps in the process-wide launcher registry and never removes them, so they stay in launcher.Apps() for every later test in package api. The package passes with -shuffle=on today, but the tests now depend on each other through that registry.
    - f4 nit at cmd/rhiza/testdata/script/rex-install.txtar:43 on modal-sized-to-content: The negated regex encodes 'every bounds line is cell_bounds(..., 100, 30)' character by character ([^1]|1[^0]|...). It is hard to read and breaks silently if the default size changes. Counting the cell_bounds lines against the number of apps, or grepping for the one expected form, would say the same thing more plainly.
- qa (step review/review): passed after 1 cycle
  - cycle 1: passed, check session 074a669f-3cc9-47e4-8acf-01a1aa63901c pass (said done)
  - round 1 (cycle 1): no findings
- scope (step review/review): passed after 1 cycle
  - cycle 1: passed, check session d01961bc-2654-45ff-8f28-01a1aa63bb6f pass (said done)
  - round 1 (cycle 1): no findings
- model (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 7ea3d1b6-42fd-4c6f-93af-01a1aa63e6ed pass (said done), critic session b74a115e-7b36-4968-bbf5-01a1aa6c8013 pass (said done)
  - cycle 2: passed, check session 446865e9-dc23-4847-9052-01a1aa7b2e0d pass (said done)
  - round 1 (cycle 1): 4 findings, 1 confirmed
    - f1 major at internal/api/rex_install.go:260 on modal-sized-to-content: modal-sized-to-content is decided-by tui-modal-go-opener (proposed in this change set, answering modal-open-mechanism): the Rex action runs rhiza, which opens the modal through rexuikit's surface over Rex's control connection and can resize as content changes. The code does the option the decision rejected: the Lua action still calls rex.session.new_layer with cell_bounds fixed when rhiza rex install writes rhiza.lua, and nothing calls surface.Open or Handle.Resize. The leaf's acceptance also describes the Lua path. Model and code disagree: either build the Go opener, or re-decide (and reword the decision and acceptance) to the install-time Lua sizing that shipped, with the live-resize part split into a follow-up change set. — confirmed: modal-sized-to-content is decided-by tui-modal-go-opener (link 01M6N06Y3F..., same change set, answers modal-open-mechanism, owner-picked, not retired), which says rhiza opens the modal via rexuikit's surface over Rex's control connection and can resize. The diff keeps the rejected option: rexAppActionLua (internal/api/rex_install.go:247-265) calls rex.session.new_layer with cell_bounds fixed at install time, and no non-test code calls surface.Open or Handle.Resize. Model and code disagree; must be reconciled (build the opener or re-decide).
    - f2 minor at internal/tui/launcher/launcher.go:24 on modal-sized-to-content: The leaf says each app opens sized to its component's NaturalSize, but no registered app sets launcher.App.Component, so every real app opens at the 100x30 default (the evidence says so). True only once later change sets move apps onto components; the model does not record that dependency.
    - f3 minor at cmd/rhiza/tui.go:189 on modal-shell-hosts-component: The leaf says rhiza tui app runs every app as one rexuikit ui component themed from the background; existing apps go through modalshell.Run, which only wraps the old model in surface/program — no hosted component, no theme, no Esc handling from the shell. Accurate only as an interim; the statement overclaims.
    - f4 nit at internal/tui/modalshell/modalshell.go:78 on modal-shell-closes: The shell also closes on ui.InfoClosedMsg, which the leaf's statement and acceptance do not name.
  - round 2 (cycle 2): 4 findings, 0 confirmed
    - f1 minor at .rhiza (evidence modal-sized-to-content-qa-1) on modal-sized-to-content: modal-sized-to-content-qa-1 still verifies the leaf with a statement about the install-time cell_bounds Lua at c64eb6fa, which 73831be9 removed in favour of rhiza tui open + modalopen. The evidence describes code that no longer exists; a fresh QA evidence at the new head should supersede it.
    - f2 minor at internal/tui/launcher/launcher.go:24 on modal-sized-to-content: Still open from cycle 1: no registered app sets launcher.App.Component, so every real app opens at the 100x30 default rather than its component's NaturalSize until later change sets move the apps onto components; the model does not record that dependency.
    - f3 minor at cmd/rhiza/tui.go:203 on modal-shell-hosts-component: Still open from cycle 1: existing apps go through modalshell.Run, which wraps the old model in surface/program (now with size reporting) but hosts no rexuikit component and no theme; the leaf statement that every app runs as one component overclaims for this interim.
    - f4 nit at internal/tui/modalshell/modalshell.go:78 on modal-shell-closes: The shell also closes on ui.InfoClosedMsg, which the leaf's statement and acceptance do not name.

## Code checks

- step review/code: pass

## Sign-offs

- signoff (visit 1): approved by rule autonomous

## Sessions

- build/build, session 39b7687c-1c2e-4045-b0b8-01a1aa50afd9: tokens input 18, output 6896, cache creation 48000, cache read 522265; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 81472132-1743-4a69-b127-01a1aa520f82: tokens input 14, output 2171, cache creation 29813, cache read 356283; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 0915fd18-4681-468a-b6e2-01a1aa5230f9: tokens input 10, output 1301, cache creation 26896, cache read 236707; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session b741bd1b-5162-4689-8228-01a1aa52d11a: tokens input 12, output 2461, cache creation 29039, cache read 296081; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 609f34b7-acb9-4c4a-90ce-01a1aa52f843: tokens input 18, output 3353, cache creation 40396, cache read 506824; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 325b7cc8-f93e-4282-80ca-01a1aa53fc91: tokens input 22, output 4269, cache creation 34017, cache read 584022; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session b0eff1ec-fafe-40c8-b205-01a1aa5531df: tokens input 66, output 20486, cache creation 79953, cache read 2709456; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 911c09c8-34b2-4ffc-9db3-01a1aa61b3b4: tokens input 18, output 3340, cache creation 34342, cache read 471155; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 4f420ee8-640c-4b31-8b6e-01a1aa634af1: tokens input 12, output 1533, cache creation 42738, cache read 332075; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 2ae8b587-7694-4978-9941-01a1aa636b28: tokens input 16, output 4678, cache creation 45609, cache read 480387; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 074a669f-3cc9-47e4-8acf-01a1aa63901c: tokens input 26, output 5859, cache creation 41542, cache read 768753; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session d01961bc-2654-45ff-8f28-01a1aa63bb6f: tokens input 12, output 2071, cache creation 41949, cache read 334989; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 7ea3d1b6-42fd-4c6f-93af-01a1aa63e6ed: tokens input 16, output 3411, cache creation 40757, cache read 460064; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session b74a115e-7b36-4968-bbf5-01a1aa6c8013: tokens input 20, output 2748, cache creation 30835, cache read 511169; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 801e6f0b-7dfc-4d81-837c-01a1aa6d6f8e: tokens input 126, output 44738, cache creation 137818, cache read 7318753; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 2a05f8b0-4210-4499-9b97-01a1aa76412e: tokens input 38, output 5059, cache creation 61869, cache read 1248147; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 446865e9-dc23-4847-9052-01a1aa7b2e0d: tokens input 16, output 2865, cache creation 46303, cache read 462344; helper tokens input 0, output 0, cache creation 0, cache read 0

Totals: tokens input 460, output 117239, cache creation 811876, cache read 17599474; helper tokens input 0, output 0, cache creation 0, cache read 0