update dev branch - #2

…ependencies from go.mod.

- Add internal/version package
- Update chat command to display dynamic version
- Update GitHub Action to inject version via ldflags

- Add workspace sandbox to file tools (read_file, write_file, list_dir)
  with path traversal prevention via validatePath()
- Enforce restrict_to_workspace in exec tool; fix double cmd construction
- Enhance dangerous command detection with regex patterns covering
  sudo, separated flags, and more variants
- Change config file permissions to 0600 for API key protection
- Add config Validate() with range checks for temperature, tokens, etc.
- Fix silently ignored os.UserHomeDir() errors in config
- Extract shared SplitThink to internal/render package, eliminating
  duplication between chat.go and telegram.go
- Hoist regex compilations to package-level vars in telegram.go
- Remove unused toolStyle field and unused port CLI flag
- Add 20+ new tests: filesystem path traversal, session persistence,
  dangerous command variants, multi-turn tool calling, max iterations,
  render SplitThink coverage
- Add CLAUDE.md and development roadmap

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add cron scheduling system (at/every/cron) with persistent JSON storage
- Add manage_cron agent tool for AI-driven job management
- Add skills loader and installer with GitHub integration
- Add CLI commands: channels list/status, cron CRUD, skills CRUD
- Enhance status command with gateway, cron, and skills info
- Inject skills summary into agent system prompt
- Integrate cron service lifecycle into server mode
- Update README docs (EN/CN) with new features and CLI reference

Store.Put() now stores a deep copy of the job, and All()/Get() return
deep copies. Save() serializes under the read lock. This ensures the
tick goroutine's mutations never race with concurrent JSON encoding.

… sharper copy

Amp-Thread-ID: https://ampcode.com/threads/T-019c5788-9479-745d-a268-0e79e359c2a4
Co-authored-by: Amp <amp@ampcode.com>

Strip tree/<branch>/ and blob/<branch>/ segments from GitHub web URLs
and auto-append SKILL.md when the path points to a directory.

- Agent loop now captures LLM content on every iteration, not only when
  tool calls are absent, preventing the "Processing complete." fallback
  from masking actual responses.
- Channel manager filters outbound messages with metadata type
  "heartbeat" so internal health-check logs no longer reach end users.

Prints version, OS, and architecture (e.g. "golem v0.5.3 linux/amd64").
Version is injected at build time via -ldflags.

Use runtime/debug.ReadBuildInfo() so that binaries installed via
go install display the tagged module version instead of "dev".

Introduce internal/command/ package with a registry-based slash command
framework. Commands are intercepted in processMessage() before the LLM
call, working across all channels (TUI, Telegram, Discord, etc.).

Built-in commands: /help, /new, /version, /status, /cron, /skills, /memory

Rewrite all command outputs to use proper markdown (bold headers, bullet
lists, code backticks) so glamour and Telegram renderers display them
correctly. Also auto-generate release notes summary instead of static
placeholder.