feat: interactive session with tabular output

[iamteedoh]

What does this PR do?

Follow-on to #7. Once a path resolved, the tool was still awkward to actually use: every single check meant relaunching the script and retyping every answer, and the results were flat lines that got hard to scan past a handful of paths.

Changes

• The session stays open. After a result it asks for another path, reusing the class and permission already chosen, until you press q. Only the fully interactive run loops — supplying everything via flags still checks once and exits, which is what keeps the tool usable from cron and CI.
• An all option for permissions, matching the one the who prompt already had. --perm all (or a at the prompt) checks read, write and execute together; combined with --all it gives the full 3×3 matrix of every permission against every class.
• Results render as a table: bordered, with headers, one row per path, and alternating row shading so neighbouring rows stay distinct. YES/NO remain green/red.

┌─────────────┬─────────────┬─────────────┬─────────────┬────────────┐
│             │    Owner    │    Group    │    Other    │            │
│ Path        │  R   W   X  │  R   W   X  │  R   W   X  │ Mode       │
├─────────────┼─────────────┼─────────────┼─────────────┼────────────┤
│ /etc/passwd │  ✓   ✓   ·  │  ✓   ·   ·  │  ✓   ·   ·  │ -rw-r--r-- │
└─────────────┴─────────────┴─────────────┴─────────────┴────────────┘

A bug this surfaced

Driving the session interactively caught something worth calling out, because it refines a rule #7 had just documented. #7 said "a regular file is read as a list of paths" — so typing /etc/passwd, the single most obvious thing anyone would permission-check, parsed its contents as paths:

│ nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false │ — │ does not exist │
│ root:*:0:0:System Administrator:/var/root:/bin/sh          │ — │ does not exist │

A regular file is now only read as a list when it looks like one — its first meaningful line being a path (/, ~, $). --file still forces the list reading unconditionally. The README documents the rule.

Design notes for review

• Checking and rendering are now separate. Rows are collected into arrays first so the table can size each column to the widest value it is about to print.
• Column widths use explicit display widths, not ${#s}. ${#s} counts bytes outside a UTF-8 locale, so an em dash would measure 3 columns instead of 1 and skew every border. Alignment is verified under LC_ALL=C.
• Zebra striping sets the background once per row and closes it at end of line. Anything colored inside a row returns to the default foreground with a fg-only reset rather than a full reset, which would drop the row's background partway along the line.

Related issue

DIR-3

Validation

git ls-files '*.sh' | xargs shellcheck          # clean
git ls-files '*.sh' | xargs -n1 bash -n         # clean
./tests/run_tests.sh                            # 47 passed, 0 failed
gitleaks git . --config .gitleaks.toml          # no leaks found

• 47 tests pass, up from 33, including 11 pty-driven tests. The session loop, the q exit, the table, and the row striping only exist with a real terminal, so tests/interactive_test.py drives them through a pseudo-terminal.
• Table assertions replace the YES/NO line-format assertions the previous suite used, since this changes that output format.
• Driven end-to-end on macOS (bash 3.2): the session loops, reuses who/perm, reports a bad path without exiting, and quits cleanly on q.
• Rebased onto main after feat: check paths directly, with tilde/variable expansion and prompt history #7 merged; main's post-squash tree was identical to the pre-squash tree, so the replay was conflict-free. Verified green on the new base.

Checklist

• git ls-files '*.sh' | xargs shellcheck passes
• git ls-files '*.sh' | xargs -n1 bash -n passes
• gitleaks reports no secrets in Git history
• Scripts and programs include a GPL-3.0-or-later SPDX header
• No secrets, tokens, credentials, or private infrastructure details are committed
• Documentation is updated for user-visible or operational changes
• The PR title follows Conventional Commits