Harden Program-aware CLI and TUI error, progress, and command flows

## Parent

- #5

## What to build

Move CLI and TUI clients onto the typed Engine Program contract while keeping command routing, optional UI dependencies, responsiveness, and cancellation outside the pure language core.

## Frozen client boundary

- `help` and `la` remain client commands and are rejected by Engine parsing.
- Engine work runs in a worker. CLI/TUI poll worker completion and token state; the core has no Python progress callback.
- The clients use one RFC-0004 `CancellationToken`; TUI cancellation never blocks its event loop.
- The reference clients apply a five-second relative timeout while core Engine methods have no default timeout.
- Missing Rich/Textual extras produce the package-boundary messages from #14.

## Acceptance criteria

- [ ] Single expressions and Programs render every ordered typed result and trailing metadata.
- [ ] Parse, validation, evaluation, budget, batch, cancellation, and deadline errors render by structured fields without tracebacks.
- [ ] `help` and `la` are client commands and fail in pure Engine parsing.
- [ ] Long batch/function work is cancellable through worker-plus-token polling without a core callback.
- [ ] The TUI event loop remains responsive throughout Engine work.
- [ ] Smoke tests cover Program, roll, batch, error, command, optional-dependency, timeout, and cancellation paths.

## Blocked by

- #14
- #19
- #22
- #26
- #38

Start with the typed Engine Program contract and the CLI/TUI worker-plus-CancellationToken flows described in this issue, after reviewing blockers #14, #19, #22, #26, and #38. Run the smoke tests covering Program, roll, batch, error, command, optional-dependency, timeout, and cancellation paths. Done means all listed acceptance criteria pass without tracebacks, while the TUI remains responsive and the pure core stays free of client callbacks.

Written by the indexing model from the issue text.