Summary

Phase 5 of Untrusted Content Isolation epic (#1195): TUI integration for security visibility.

• Status bar: yellow "SEC: N flags" indicator for injection pattern detections, red "N blocked" for exfiltration guard blocks. Hidden when zero events.
• Security side panel: aggregate metrics (sanitizer runs, injection flags, truncations, quarantine, exfiltration) + last 5 recent events with timestamps. Time-based toggle (60s recency) replaces Subagents panel only when recent events exist.
• Command palette: security:events command outputs full security event history as system message (command palette only, no slash shortcut).
• SecurityEvent types: SecurityEvent + SecurityEventCategory enum in zeph-core (unconditional, not feature-gated). Ring buffer (VecDeque, cap 100) in MetricsSnapshot, transported via existing watch channel.
• Emission sites: SecurityEvent pushed at Agent call sites (context.rs, tool_execution.rs, persistence.rs) — not inside sanitizer structs. Covers injection flags, truncations, quarantine success/failure, exfiltration URL flags, image blocks, memory write guards.
• Safety: UTF-8-safe truncation via floor_char_boundary() for detail (128 chars) and source (64 chars), ASCII control char stripping on source field.

Key files

• crates/zeph-core/src/metrics.rs — SecurityEvent, SecurityEventCategory, ring buffer
• crates/zeph-core/src/agent/utils.rs — Agent::push_security_event()
• crates/zeph-tui/src/widgets/security.rs — security side panel widget (new)
• crates/zeph-tui/src/widgets/status.rs — status bar SEC indicator
• crates/zeph-tui/src/command.rs — SecurityEvents command palette entry
• crates/zeph-tui/src/app.rs — format_security_report(), panel toggle, event handling

Test delta

4064 -> 4088 (+24 new tests)

Test plan

• cargo +nightly fmt --check
• cargo clippy --workspace --features full -- -D warnings
• cargo nextest run --workspace --features full --lib --bins (4088 passed)
• Manual TUI verification: trigger injection pattern, verify SEC indicator appears in status bar
• Manual TUI verification: :security:events in command palette shows event history
• Manual TUI verification: security panel appears and auto-hides after 60s

Closes phase 5 of #1195.