lembas -l / --local: everything in the project, nothing written elsewhere

Config, data and state are rooted at <project>/.agent/local/lembas (or
.lembas/), kept out of git; a local directory the repository carries is
refused. The user's logins and connections.yaml are read, never written; the
user's config.yaml is not read. The TUI is started with TMPDIR inside it (the
compiled binary unpacks its native library there) and OpenTUI's cache goes
there too; the agent's commands keep the user's TMPDIR.

An instance serves models, chat, speech and the balance only: the link,
/remote, the service and the hub are off, deletes are not sent, and the server
library, search, fetch, embeddings and personalization are not used.
Self-update and uninstall are refused. hardline_disable is ignored, and tools
treat the local directory as outside the project.

The smoke test runs a whole local session in the compiled binary and checks
that HOME, the XDG directories and TMPDIR gained nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/tool/bash.ts

@@ -14,8 +14,15 @@ const GIT_SAFE: [string, string][] = [
   ["core.pager", "cat"],
   ["safe.bareRepository", "explicit"],
 ]
+// Local mode starts the TUI with TMPDIR inside the project, for this program's own files; the
+// commands keep the TMPDIR they had (LEMBAS_OUTER_TMPDIR, empty when there was none).
+const { LEMBAS_OUTER_TMPDIR: outerTmp, ...startEnv } = process.env
+if (outerTmp !== undefined) {
+  if (outerTmp) startEnv.TMPDIR = outerTmp
+  else delete startEnv.TMPDIR
+}
 const ENV = {
-  ...process.env,
+  ...startEnv,
   // A command can tell it runs under the agent.
   LEMBAS: "1",
   GIT_PAGER: "cat",