feat: implement delegate user input prompting

[sanity]

Problem

RequestUserInput was stubbed at delegate.rs:348-360 -- every request was auto-approved by fabricating a Response::Allowed using token-generator-specific types hardcoded into the runtime. This meant any web page could silently trigger delegate operations (like ghostkey signing) without user consent.

Approach

Replace the stub with proper user prompting infrastructure that follows the existing contract request pattern:

1. Runtime pass-through: RequestUserInput now flows through process_outbound() to the executor loop, just like GetContractRequest/PutContractRequest
2. UserInputPrompter trait: Abstraction for prompting with three implementations:
   • SubprocessPrompter (production): spawns freenet prompt as a child process
   • AutoApprovePrompter (testing): returns first response immediately
   • AutoDenyPrompter (headless): always denies
3. freenet prompt subcommand: Native OS dialogs via zenity/kdialog (Linux), osascript (macOS), PowerShell (Windows), with terminal fallback. Returns selected button index on stdout.
4. 60s timeout: Auto-denies to prevent indefinite blocking

The delegate's own WASM code handles context updates via InboundDelegateMsg::UserResponse (already implemented at delegate.rs:541). The runtime no longer touches delegate-specific types.

Key design decisions

• Subprocess pattern: The prompt runs as a child process to get its own main thread for GUI event loops (macOS Cocoa and Linux GTK require main thread). No event loop conflicts with the node's tokio runtime.
• Platform-native dialogs: Uses OS-provided dialog tools (zenity, osascript, PowerShell) for truly native look. Future enhancement: wry+tao webview for rich HTML dialogs with custom styling.
• Executor loop integration: RequestUserInput is intercepted and fulfilled in handle_delegate_with_contract_requests(), following the exact same pattern as contract requests (GET/PUT/UPDATE/SUBSCRIBE).

Testing

• 4 new unit tests for UserInputPrompter implementations
• All 2132 existing tests pass (including delegate tests that previously relied on the auto-approve stub)
• cargo fmt and cargo clippy clean

Closes #1499

[AI-assisted - Claude]

[github-actions]

Rule Review: Minor style issues only — no blockers

Rules checked: code-style.md, testing.md, git-workflow.md, contracts.md
Files reviewed: 8 (mod.rs, prompt.rs, freenet.rs, contract.rs, user_input.rs, p2p_impl.rs, in_memory.rs, delegate.rs)

Warnings

None.

Info

• crates/core/src/bin/commands/prompt.rs:303 — drop(stdin.write_all(message.as_bytes())) silently swallows stdin write failure in the macOS path. If the write fails, osascript reads empty stdin, the msg AppleScript variable is empty, and the function falls through to return Some(-1). Safe-fail, but silent misbehavior. Prefer stdin.write_all(message.as_bytes()).ok(); child.stdin.take(); or a return None on error. (rule: code-style.md — use explicit match/if-let in production code)

• crates/core/src/bin/commands/prompt.rs:341 — drop(f.write_all(data.to_string().as_bytes())) same pattern in the Windows path. If the temp file write fails, PowerShell parses an empty/truncated JSON, $form.Tag stays at -1, and the function returns Some(-1). Again safe-fail but worth propagating. (rule: code-style.md)

• crates/core/src/contract/user_input.rs:901 — AutoDenyPrompter carries #[allow(dead_code)] with a comment promising future wiring. The comment is clear, but consider leaving a // TODO(config): marker or tracking it in an issue so it doesn't linger indefinitely. (rule: code-style.md)

---

Rule review against .claude/rules/. WARNING findings block merge.

[sanity]

/ack

The handle_delegate_with_contract_requests integration test gap is acknowledged. The prompter logic has 18 unit tests covering all implementations, sanitization, and edge cases. A full integration test requires a complete ContractHandler setup (WASM delegate that emits RequestUserInput), which is significant infrastructure work. The AutoApprovePrompter injection ensures all existing delegate tests exercise the new pass-through path.

The info items (AutoDenyPrompter doc comment, constant rationale) are addressed in the latest commit.

[AI-assisted - Claude]