Show live per-app progress in the CLI and colour the preview report

[adamXbot]

Why

privacycommand preview / upgrade gave no feedback while they worked — the only sign of life was network activity. A one-line spinner didn't fix it: on a 50-column terminal panel it was cut down to Analyzing 6 installed apps — 0 of 6 done…, losing the app name and step.

What changes

Live progress board (terminal only). preview and upgrade draw a board on stderr: one row per app with marker, name, version and current step, plus a footer with the spinner, a done count and elapsed time. With --fetch / upgrade the rows continue through ↓ downloading — 4.6 MB so far, opening the download, analyzing the new build — <step> and the outcome (✓ no privacy-relevant changes / ⚠ 3 changes · risk 14 → 22). The board erases itself before the report prints.

• Markers and colours match the interactive browser's list (· queued, ~ working, ↓ downloading, ✓ clean, ⚠ noteworthy, ✗ failed, – skipped).
• Nothing wraps: every line is clipped to the terminal width; the version column is dropped first so the step text survives at 50 columns; when there are more apps than screen rows, finished rows hide first behind … +N more (k done, j queued).
• ProgressBoard (CLIKit) is the pure layout with 8 unit tests; StatusBoard (CLI) is the stderr driver and replaces Spinner.swift. The one-shot audit uses it too.
• Only drawn when stderr is a TTY; log prints notes above the board so they never land mid-frame.

Report. Coloured like audit (tier colour on the headline, [error]/[warn] tags, ✓/⚠ markers, red held:), cask versions shown without brew's build hash (3.23.12 → 3.24.9, not 3.23.12,2d29876d…; JSON keeps the full string). --no-color added to preview and upgrade (honours NO_COLOR); completion tables updated.

TUI. The analyzer's step is shown under "Analyzing …" in the detail pane (a second inbox from the worker to the main loop), so a slow app no longer looks stuck.

Core. HomebrewCaskInventory.outdatedScan(progress:) and CaskArtifactFetcher.withDownloadedApp(progress:) report their phases; partialFile(for:) names brew's <cache>.incomplete download file, which gives the bytes so far.

Piped output and --json are byte-for-byte unchanged.

Testing

• 313 core + 61 CLI-kit tests pass (9 new); just check passes; --tui-selftest passes.
• Pseudo-terminal captures at 50 and 70 columns, checked frame by frame: 675 and 929 repaints, every cursor move correct, no line over the width.
• Real runs in a Terminal panel: preview (6 casks) and upgrade iterm2 (download → analyze → diff), board cleared and report printed cleanly beneath.
• preview iterm2 nosuchcask > out 2> err: stderr holds only the note, stdout has no escape codes; --json parses.

🤖 Generated with Claude Code