Refactor shellgenius output flow and default to gpt-5.4-mini

[sderev]

What changed

• Migrate the OpenAI integration to the current openai SDK and the Responses API, while keeping the n fallback path and rejecting unsupported stop values for GPT-5.4-family models before any API call.
• Add pytest and scriv scaffolding, plus mocked and opt-in real smoke tests for the GPT-5.4 family.
• Parse model output through shellgenius.response_parser instead of an inline regex.
• Refactor the CLI for TTY-aware output and execution, add --model, --no-stream, --plain, --command-only, --execute, and --yes, and make --execute honor the parsed shell fence instead of silently switching shells.
• Default the CLI to gpt-5.4-mini, update the README and changelog fragments, and make .ci/gate run each Python version in an isolated environment.

Why

• Non-interactive use should print output and exit, not block on a prompt.
• The project should use the current OpenAI SDK and a current default model.
• The CLI needed tests and a clear output contract before changing model and TTY behavior.
• --execute should not accept one shell fence and run the command in a different shell.
• gate should be a reliable multi-version preflight.

How to test

• gate
• uv run --group dev pytest -q tests/test_cli.py tests/test_response_parser.py
• uv run --group dev pytest -q tests/test_openai_real_smoke.py --run-live -m real
• Manual checks:
  • uv run shellgenius "list files in the current directory"
  • uv run shellgenius --plain "list files in the current directory"
  • uv run shellgenius --command-only "list files in the current directory"
  • uv run shellgenius --execute "print ok" and answer n
  • uv run shellgenius --execute --yes "print ok"
  • uv run shellgenius --execute "list files" </dev/null and confirm it fails with --yes guidance instead of hanging

Risk/comp notes

• The default flow no longer asks whether to execute the generated command. Execution now requires --execute.
• --execute now follows the parsed fence language and rejects incompatible shell fences on the current platform.
• The default model is now gpt-5.4-mini, so users need access to that model or must override --model.
• GPT-5.4-family models now raise a clear error when callers pass stop, because that parameter is not supported on the current SDK path for those models.
• Real smoke tests remain opt-in because they require credentials and model access.

Changelog fragment: yes (CLI behavior and default model changed)