v3.5.1 fix: critical char-boundary panic (was dropping findings) + background runs, progress bar, severity colors, /help

CRITICAL BUG: truncate()/source-context slices cut strings by BYTE, panicking on
a multibyte char (e.g. '—'). The panic crashed agent tasks → task.await returned
JoinError → unwrap_or_default() → empty RunOutput. Result: real confirmed findings
(win.ini traversal, HTML injection) were silently lost, workdir was empty, report
missing. Now all string truncation is char-safe (models.rs, pipeline.rs, repl.rs).

Also:
- Background runs: /run now runs in the BACKGROUND via rustyline's ExternalPrinter
  — the REPL keeps accepting commands while the engagement streams live. New
  /status (live phase + progress bar + findings) and /stop (graceful). Findings
  persist to history + report on completion (finalize_run ensures workdir is set
  even on abort, fixing "no report file in ").
- Progress bar: agents-done/total with %, shown in /status.
- Severity colors in the live feed (Critical=red…Info=grey); confirmed vote = green.
- /help reformatted into clear aligned sections.
- TUTORIAL: document non-blocking runs, /status progress, /stop, colors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

TUTORIAL.md

@@ -247,6 +247,20 @@ A context bar shows `model auth · cwd · mode▸target`. Key commands:
 Line editing: **↑/↓** history, **Tab** completes commands & `@paths`, **Ctrl-A/E/K**,
 end a line with **`\`** for multiline.
 
+### Runs are non-blocking
+
+`/run` launches the engagement **in the background** and immediately returns the
+prompt — you keep typing while it streams live above the prompt. While it runs:
+
+- **`/status`** — live phase, a **progress bar** (agents done / total), elapsed
+  time, token/cost and the possible findings so far.
+- **`/stop`** — gracefully stop (a report is still generated from partial results).
+- Findings are color-coded by severity (Critical = red … Info = grey), and a
+  confirmed vote shows green ✓.
+- When it finishes you get `◀ run #n done — N validated finding(s) · /results n · /report n`.
+
+(When stdin is piped/non-interactive, `/run` falls back to blocking mode.)
+
 ---
 
 ## 7. Mission Control TUI