Add privacy-safe CLI and TUI recordings

[tony]

Summary

• Keep the synthetic recording corpus, recorder inputs, rendered media, and still posters together under docs/_static/demos/.
• Record 16 VHS scenarios across root help, search, grep, find, JSON/NDJSON, and two TUI workflows, plus canonical asciinema casts for search, grep, find, and ui.
• Add a local-only {terminal-demo} directive that derives intrinsic geometry from an explicit poster and emits a native, no-JavaScript MP4 player with accessible builder fallbacks.
• Embed six primary CLI and TUI recordings in their reference pages, while the README keeps linked posters with explicit dimensions.
• Publish the 16 MP4 recordings and six posters through Sphinx while keeping casts, tapes, helpers, GIFs, and WebMs out of the static copy.
• Keep the recording and documentation work in ten reviewable commits, with the pnpm regression fix in one separate CI commit.

Color and safety

• Seed only synthetic Codex, Claude, Cursor, and Gemini history, and neutralize every catalogued store override plus the WSL host probe before agentgrep starts.
• Reject seeding outside the fixed synthetic sandbox before cleanup.
• Remove ambient NO_COLOR and FORCE_COLOR at the recording boundary and set truecolor explicitly. The old environment made Textual install its no-color filter, which stripped the TUI palette and materialized terminal-default backgrounds as black.
• Scan sources, casts, captures, and metadata for developer paths, emails, credentials, secrets, and non-synthetic prompt content.

Preview

CLI

TUI

Verification

• rm -rf docs/_build; uv run ruff check . --fix --show-fixes; uv run ruff format .; uv run ty check; uv run py.test --reruns 0 -vvv; just build-docs;
• 2,301 tests passed, 3 skipped, and 3 strict xfails remained expected; 2 snapshots passed.
• Both TUI capture families decode at 1200 by 700 across GIF, MP4, and WebM; their populated posters decode at the same geometry.
• The built site contains native players for all six referenced demos, with typed MP4 sources, intrinsic dimensions, controls, and preload="none".
• The built site contains all 16 MP4s and six posters under _static/demos/, with no recorder sources or alternate media in the static demo copy.
• Focused directive tests cover asset confinement, required alt/poster metadata, playback sources, copied files, and non-HTML fallbacks.
• The final pull-request docs and test jobs passed after removing the temporary preview deployment; normal master-only publication rules are restored.

Goal

Idempotent completion condition for /goal. It asserts an end state, not an action: if the state already holds, the first evaluation passes and nothing is edited.

/goal Work in a worktree on branch screen-recording set to PR #123's pushed head, where its demo assets live; never check it out in the master tree, never push. Report all five before editing; stop with no edits if all pass. (1) git rev-parse --abbrev-ref HEAD prints screen-recording. (2) tests/test_terminal_demo_docs.py carries a module-level documentation mark plus slow on its Sphinx-building nodes; it carries none today, so five in-process builds sit in the default lane. (3) git diff master...HEAD --name-only shows no src/agentgrep/ path and merge-tree of local master and HEAD shows no CONFLICT (true today, keep them). (4) A scan of the committed .tape, .cast, .sh, .py and .md files under docs/_static/demos finds zero developer home paths, emails or real store paths, synthetic .codex/sessions strings excepted; report the count. (5) After just build-docs, docs/_build/html/_static/demos exists and holds no .tape, .cast, .gif or .webm while the six posters and the MP4s are present; a missing directory FAILS this check. Run both under NO_COLOR=1 with VIRTUAL_ENV and UV_NO_SYNC unset; report the warning count. Constraints: check 3's zero src/agentgrep footprint leaves ADR 0011 untouched. The terminal-demo directive stays in docs/_ext/, out of the wheel, with no runtime dependency. Regeneration stays opt-in and offline: no pytest lane or docs build invokes VHS, asciinema, ffmpeg, Docker or the network; the demo corpus must not become a shared fixture; add no retained CI gate. Leave the unpublished .gif and .webm alternates alone; pruning is the user's call. Pin no search, ranking, limit, cursor, record-ID, index or provider contract; recordings are illustrative and stay regenerable when #113/#115/#142/#143 change output. Or stop after 8 turns and report what remains.

• Proof — git rev-parse --abbrev-ref HEAD; rg -c '^pytestmark' tests/test_terminal_demo_docs.py || echo 0; git diff master...HEAD --name-only | rg -c '^src/agentgrep/' || echo 0; git -c rerere.enabled=false merge-tree --write-tree master HEAD | rg -c '^CONFLICT' || echo 0; rg -l -g '*.{tape,cast,sh,py,md}' '/home/|/Users/|[a-z0-9._-]+@[a-z0-9.-]+\.[a-z]+' docs/_static/demos | wc -l; NO_COLOR=1 env -u VIRTUAL_ENV -u UV_NO_SYNC .venv/bin/python -m pytest tests/test_terminal_demo_docs.py -q && just build-docs && ls docs/_build/html/_static/demos >/dev/null && find docs/_build/html/_static/demos \( -name '*.tape' -o -name '*.cast' -o -name '*.gif' -o -name '*.webm' \) | wc -l
• Idempotence — Re-running in a satisfied worktree only re-prints screen-recording, one pytestmark, zero src/agentgrep paths, zero CONFLICT lines, zero privacy hits and zero leaked source assets from an existing built site; every check is a read-only observation, and a missing build directory fails rather than silently passing, so nothing re-fires an edit.
• Blocked by — nothing hard; Concept: Local insights reports with model-backed enrichment #87's pyproject edge is already absent from the pushed head and does not have to land first
• Blocks — nothing; docs-only, no retained CI gate, and the demo corpus is barred from becoming a fixture other tests depend on
• Preserves — The branch keeps its zero src/agentgrep/ footprint, so the ADR 0011 non-blocking TUI contract is untouched by construction and no pump path is added. The terminal-demo directive stays a docs/_ext build-local extension rather than shipped API, and adds no runtime dependency. Recordings stay illustrative: no CLI output format, ranking, limit, cursor token, record ID, index presence or provider seam is asserted, so search --limit discards the best results (limit caps in scan order, not result order) #113, search relevance scoring measures length, not relevance #115, Durable prompt corpus and derived search indexes (ADR 0019) #142 and Progressive deep search: the --deep / --exhaustive effort ladder (ADR 0020, ADR 0021) #143 may change what agentgrep prints and the demos are simply re-recorded. The unpublished .gif and .webm alternates are left in place for the user to decide, and regeneration stays opt-in and offline.