fix(providers): skip the trust and init questions where the person already answered

[omartelo]

Why

Follow-up to #796, which did this for Claude Code. The other providers still opened a session lich started unattended (a relayed task, a race, lich open --prompt) on a blocking first screen:

• Codex, Cursor CLI and Antigravity ask "trust this folder?".
• Crush asks "initialize this project?", and Enter runs an init turn.
• A sandboxed oh-my-pi opens on its setup wizard.

Each provider was measured in a real PTY with isolated config: where it keeps the answer, which flows ask, which knob skips the question, and whether it keeps an entry lich writes while a session runs (all four do).

Provider	Asked where it should not	Fix
Codex 0.144.5, 0.162.1	sandbox only: worktrees resolve to the main checkout, profiles already merge trust	confined: -c projects={"<main checkout>"={trust_level="trusted"}} (the dotted form still asks)
Cursor CLI 2026.10.16	worktrees (a worktree sits beside its repo, and trust is per folder and its parents), sandbox	worktree of a trusted checkout: write ~/.cursor/projects/<slug>/.workspace-trusted; confined: --trust
Antigravity 1.3.5	every folder not on its exact list: worktrees, subfolders, sandbox	add the folder to trustedWorkspaces when its checkout's top or main checkout is listed, and for every confined session
Crush v0.98.1	every new checkout	write .crush/init (plus Crush's own * .gitignore) at the checkout's top before every spawn
oh-my-pi 18.8.9	setup wizard in the sandbox (a profile's config.yml links into Personal, which is not mounted)	confined: OMP_SKIP_SETUP=1

opencode and Kiro CLI ask nothing.

What changes

• internal/terminal/sandbox.go:
  • confinedEnv, a per-provider map that now holds Claude Code's CLAUDE_CODE_SANDBOXED and oh-my-pi's OMP_SKIP_SETUP;
  • confinedTrustArgs for Codex and Cursor CLI.
  • The sandbox verdict is decided before the argv, so the flags can go first.
• internal/terminal/cursor_trust.go: the marker's slug rule and parent walk, read from the Cursor bundle (src/workspace/approval.tsx, workspace-paths.js).
• internal/terminal/antigravity_trust.go: a read, edit and atomic rename of settings.json that keeps the other keys. A trusted parent alone never counts: Antigravity itself does not count it, and a trusted home would trust everything.
• internal/terminal/crush_init.go.
• docs/ceilings.md, the Provider support table in every README, and CHANGELOG.md.

Decisions

• Antigravity carries trust to worktrees and subfolders as well as the sandbox. The entry persists, so the folder also opens without the question outside lich.
• Crush is marked in every session, not only confined ones, so the offer to write AGENTS.md never comes up in a lich session.

Verification

• gofmt -l . and go vet ./... clean, go test ./... green.
• GOOS=darwin and GOOS=windows go vet clean on internal/terminal.
• End to end against the real CLIs in a PTY: each one asks without lich's write or flag, and opens at its prompt with it. That covers Codex 0.144.5 and 0.162.1, Cursor CLI (marker and --trust), Antigravity and Crush; git status stays clean after Crush.
• Not measured:
  • whether Codex's trust or Cursor CLI's --trust loosen anything beyond the question;
  • Windows path spellings;
  • OMP_SKIP_SETUP through a real bwrap (taken from the survey's measurement);
  • an end-to-end run through a lich window.