Integrate syntax highlighting into diff rendering and markdown code
blocks, with proper line wrapping that preserves styled spans.

- Add detect_lang_for_path() for extension-based language detection
- Syntax-aware diff rendering for Add/Delete/Update file changes
- wrap_styled_spans() splits long highlighted lines across display rows
- Buffer fenced code blocks in markdown_render for batch highlighting
- Add snapshot tests for highlighted diff wrapping
- Replace code_block_unhighlighted test with 3 syntax color assertions

The exec approval modal's command line now gets syntax-colored spans
from syntect (base16-ocean.dark) instead of tree-sitter-bash.

No crate references it after the TUI switched to syntect.

… theme

Replace syntect's default ~40 language set with two-face's bat-sourced
~250 language set, adding support for TypeScript, TSX, Kotlin, Swift,
and Zig. Auto-detect terminal background to pick CatppuccinMocha (dark)
or CatppuccinLatte (light). Suppress italic modifier by default since
many terminals render it poorly.

two-face's ~250 language syntax set resolves almost all names and
extensions on its own. Remove the redundant normalize_lang layer and
keep only 3 patched aliases (golang, python3, shell) that two-face
cannot resolve. This enables highlighting for any language in bat's
syntax set (elixir, haskell, scala, dart, php, html, css, etc.)
without needing explicit entries.

Add `[tui] theme = "..."` config option that lets users override the
auto-detected syntax highlighting theme with any of the 32 bundled
two-face themes by kebab-case name. Invalid names log a warning and
fall back to adaptive detection.

Also suppress FontStyle::UNDERLINE in convert_style — themes like
Dracula mark type scopes with underline which produces distracting
underlines on type/module names in terminal output.

trim_end_matches('\n') stripped all trailing newlines from the code
block buffer before highlighting, discarding intentional blank lines
authored inside fences. pulldown-cmark appends exactly one trailing
'\n' to the text content, and LinesWithEndings handles it correctly
as a line terminator, so no trimming is needed. Remove the trim to
preserve user-authored blank lines faithfully.

Two fixes:

1. highlight.rs: The fallback path used split('\n') which produces a
   phantom empty trailing element for inputs ending in '\n' (as
   pulldown-cmark emits for code blocks). Switch to lines() which
   handles trailing newlines correctly.

2. diff_render.rs: wrap_styled_spans only flushed the current line
   when col >= max_cols AND the current span had remaining content.
   This missed the case where one span ends exactly at max_cols and
   the next span has content — the next span's first character was
   appended to the already-full line. Remove the !remaining.is_empty()
   guard so the line flushes at span boundaries too.

Extend theme resolution so `theme = "foo"` checks
~/.codex/themes/foo.tmTheme before falling back to auto-detection.
Surface unresolved theme names as a ⚠ startup warning in the TUI
via the existing startup_warnings pipeline.

Two fixes from code review:

1. `trim_end_matches('\n')` left a stray `\r` on CRLF inputs, which
   propagated into rendered code blocks and diffs. Now strips both
   `\r` and `\n`.

2. Unified diff highlighting called `highlight_code_to_styled_spans`
   per line, bypassing the global size guardrails (max bytes/lines).
   On large patches this triggered thousands of parser initializations.
   Added a pre-check on aggregate patch size that skips highlighting
   when limits are exceeded.

- Tabs in syntax-highlighted diff spans now count as 4 columns instead
  of zero, so tab-indented code wraps correctly in the diff view.

- Move theme warning injection to after the last possible config reload
  (session resume/fork) so the ⚠ banner is not silently discarded.

`set_theme_override` was called with `initial_config.tui_theme` before
onboarding/resume/fork could reload config. Because the theme state
lives in a `OnceLock`, it was permanently locked to the initial value.

Move the call to after the last possible config reload so the theme
and its warning always reflect the final session config.

Add a `/theme` slash command that opens an interactive picker listing
all bundled and custom (.tmTheme) syntax themes. The picker shows a
live-preview code snippet below the list that re-highlights as the
user navigates, and restores the original theme on cancel.

Key changes:
- ListSelectionView gains `footer_content`, `on_selection_changed`,
  and `on_cancel` to support rich preview and lifecycle callbacks
- highlight.rs: swap global Theme from OnceLock to RwLock for live
  swapping; add resolve/list/set/current helpers for theme management
- New theme_picker module with ThemePreviewRenderable and picker builder
- diff_render: make DiffLineType and helpers pub(crate); fix rename
  highlighting to use destination extension
- markdown_render: fix CRLF double-newlines and info-string metadata
  parsing for fenced code blocks

Extract selected_actual_idx() helper and guard move_up/move_down so
the callback is skipped when wrapping doesn't change the selected
item (e.g. single-item lists). Adds a test for the single-item case.

set_theme_override now updates the runtime theme immediately instead
of only setting the OnceLock, enabling live switching from /theme.
Replace hardcoded ~/.codex/themes references with resolved
$CODEX_HOME/themes paths in warnings, schema docs, and picker subtitle.

Add `RUSTSEC-2024-0320` and `RUSTSEC-2025-0141` to the `ignore`
list in `codex-rs/deny.toml`.

Both advisories are pulled in via `syntect v5.3.0` used by
`codex-tui` syntax highlighting and currently have no fixed release.
This keeps `cargo deny` focused on actionable findings while the
exception is tracked with a TODO.

Regenerate `codex-rs/core/config.schema.json` with `just
write-config-schema` so the fixture matches the current `ConfigToml`
schema output.

This fixes `config_schema_matches_fixture` in CI after the
syntax-highlighting `theme` description changed to mention
`kebab-case` naming.