features: /changes, /search, /fork, web_search, prompt memoization, per-turn spend cap, workspace refresh

- /changes diffs the last turn's file snapshot (added/modified/deleted), reusing undo infra via SnapshotStack.peek()
- system prompt memoized behind version counters (notebook/memory/skills/plugins/tools/workspace); hit-rate in /cost, foundation for provider caching
- web_search: DuckDuckGo Lite, keyless, 5 results, SSRF-filtered, in the net set with ask permission
- /search <query>: full-text grep over saved sessions incl. tool-input JSON
- workspace file list re-walks at a turn boundary after writes
- maxSpendPerTurn: per-turn cap stops a runaway step with a notice
- /fork: branch the session at the last turn boundary, original untouched

821 tests pass, typecheck clean, build green

docs/headless.md

@@ -16,7 +16,7 @@ There is no terminal to approve on, so every gated tool is denied unless `--yolo
 
 ```
 $ shiro -p "add a test for paginate()"
-shiro: headless denies write_file, edit_file, multi_edit, apply_patch, bash, web_fetch and mcp tools unless --yolo is passed
+shiro: headless denies write_file, edit_file, multi_edit, apply_patch, bash, web_fetch, web_search and mcp tools unless --yolo is passed
 [tool] write_file {"path":"test/paginate.test.ts",...}
 [denied] write_file (run with --yolo to allow tool use in headless mode)
 ```