support structured agent questions via ACP forms

[lnittman]

Important

This is a scoped reference implementation in Luke's fork, not a pull request
against block/berd. Berd's contribution policy accepts outside participation
through issues; upstream product/design discussion is
block/berd#114.

End-to-end managed-provider proof depends on the Goose forwarding work proposed
in aaif-goose/goose#11346.
The live captures used an exploratory dirty Goose checkout; this branch does
not vendor or pin those backend changes and is not claiming clean-backend
reproducibility before that prerequisite lands.

Summary

Add ACP form elicitation to Berd's existing chat interaction layer so an agent
can pause for structured human judgment without a prose menu. The implementation
supports single choice, true multi-select schemas, booleans, text/numbers,
typed custom Other answers, direct multi-question navigation, validation,
explicit decline/cancel, accessible focus, background attention, and honest
restart recovery.

There is deliberately no Interviews widget or Home node. Rich media, Mermaid,
arbitrary model-authored UI, and Cursor's custom question extension remain out
of scope for this slice.

Architecture

managed ACP provider
  -> nested session/elicitation/create
  -> goose serve forwarding prerequisite (#11346)
  -> Berd ACP client handler
  -> per-session elicitation store
  -> composer-area form + sidebar attention
  -> typed response back to the originating request

• Berd advertises ACP form capability and forwards the request's AbortSignal
  through the vendored Goose SDK wrapper.
• Explicit JSON-RPC cancellation removes only the matching live responder;
  connection replacement detaches the form so its draft is not destroyed.
• Pending questions are keyed and queued per session and persist navigation and
  answers; a credential-marked field is unsupported rather than rendered, so no
  secret value is ever held or serialized.
• Shared _askUserQuestionCustomAnswer metadata is preferred, with the current
  Codex adapter marker retained as a compatibility input.
• Detached questions remain editable and can continue as one normal message.
  Delivery is single-winner: the answer is claimed before it is sent, and a
  responder that reattaches after dispatch is settled without being accepted,
  so the backend cannot see both a message and a response.
• Multi-question hierarchy uses Berd's existing panel, button, radio, checkbox,
  input, typography, status-pill, and sidebar conventions.

Provider truth

• Claude Code: full structured flow proven, including true multi-select,
  custom answers, multi-question navigation, and same-turn continuation.
• Codex: structured single choice, text, and custom answers proven. Its
  current ACP adapter serializes question answers through string oneOf, so
  true multi-select intent is lost before Berd receives the schema.
• Cursor: not structured on Berd's current Goose route. Goose launches the
  direct print/JSON provider, which does not expose client tools. Cursor's
  cursor/ask_question extension needs translation at a general ACP adapter
  boundary; prose is a fallback, not parity.

Interaction and safety details

• question progress and answered-state navigation for multi-question forms;
• real question promoted above bridge boilerplate while preserving unfamiliar
  provider messages as muted context;
• native required/min/max/pattern/array validation and bounded multi-select;
• credential-marked fields are unsupported rather than rendered as password
  inputs, since ACP form mode is specified for non-sensitive data;
• focus moves into the form and returns to the prior composer target on exit;
• restart recovery says whether the agent is still waiting or the answer will go
  as a new message, rather than pretending to replay a dead RPC;
• a question is shown only by the chat that asked it, while that chat is on
  screen; a live question always takes presentation priority over a recovered
  draft, so a draft can never hide a request an agent is blocked on;
• a security confirmation owns the composer slot alone while it is up, and a
  question waits behind it;
• an agent-supplied pattern is treated as unevaluable rather than executed. A
  native regex cannot be interrupted, so running one is an unbounded cost taken
  on the sender's behalf; field, option, and byte counts are bounded instead;
• a property type Berd does not understand is preserved and shown as
  unsupported rather than rendered as a control that misdescribes it;
• an unsupported mode or scope returns invalid params rather than a synthetic
  user cancel, so a client limitation is never mistaken for a decision;
• a live question is correlated by its JSON-RPC id, so two identical questions
  asked at once stay distinct;
• answers are claimed before they are sent as an ordinary message, so a second
  send or a discard cannot race it;
• saved drafts are cleared on logout and workspace switch, since session ids are
  not unique across accounts;
• no provider-specific rendering branches and no parsing of prose into trusted
  controls.

Verification

• focused suites: 3,608 passed, 1 skipped across 257 files (elicitation,
  transport, chat, sessions, app shell)
• just check, Tauri checks, and warnings-denied Clippy green

A few timing-sensitive suites outside this change — composer mention search and
app-shell focus — flake when a dev backend competes for CPU. They pass in
isolation and fail identically with this branch stashed, so they are noted here
rather than counted. The full Vitest aggregate is ~6,785 tests and was
reproducible with the backend stopped; this head has not been re-measured under
those conditions.

Known limitations

• Persistence identity fails open. Account and workspace resolution fall
  back through several candidates, and an unresolved provider becomes
  unknown, so distinct security contexts can collapse into one namespace. It
  should stay memory-only when identity is not verifiable.
• Persistence recovery is all-or-nothing. One malformed record discards the
  whole store rather than just that record, and schema traversal is recursive
  with no depth bound.
• Recovered continuation is not bound to its origin. It resolves the
  session's current execution target at send time, so changing provider between
  a question and its answer sends the answer to a different provider.
• Accepted response size is unbounded. The request schema is capped, but
  user-entered content is not.
• Numeric fields do not preserve intermediate states like -, 0. or 1e;
  email/uri/date formats are unvalidated; length uses trimmed UTF-16
  units rather than code points; invalid fields disable the button without a
  field-level explanation.
• elicitationStore.ts and ElicitationField.tsx have grown past the point
  where they should be single modules.

Current-work coordination

The final diff is limited to ACP capability/transport wiring, the elicitation
feature, ChatView placement, and the existing sidebar status slot.

The closest active upstream branches remain block#19 (provider/model lifecycle), block#28
(composer quoting), block#67 (memory/chat surfaces), block#113 (shared transcript scroll
container), and block#115 (Changes rail PR context). Rebase/conflict review should
pay special attention to ChatView.tsx, ACP connection setup, chat i18n, and
session lifecycle files.

Refs block#114

Refs aaif-goose/goose#11346