feat(cosh): add kitty csi-u keys support with sequence timeout management

[kongld-mq]

Description

Add Kitty CSI-u keyboard protocol support with sequence timeout management to KeypressContext, enabling proper handling of printable CSI-u keys, unsupported sequences, and plain text recovery after interrupted CSI sequences.

The Kitty keyboard protocol uses CSI-u sequences (ESC[;u) for enhanced keyboard reporting. Previously, printable CSI-u keys were not handled correctly, which could cause issues with text input in CLI applications.

Key changes:

• Printable CSI-u keys (keyCode >= 32 and <= 0x10ffff, excluding DEL and PUA) now return the literal character
• Unsupported CSI-u sequences are dropped without blocking subsequent valid input
• Plain text arriving after CSI sequences is correctly recovered
• Sequence timeout (200ms) prevents indefinite blocking from interrupted sequences

Related Issue

closes #

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional change)
• Performance improvement
• CI/CD or build changes

Scope

• cosh (copilot-shell)
• sec-core (agent-sec-core)
• skill (os-skills)
• sight (agentsight)
• tokenless (tokenless)
• Multiple / Project-wide

Checklist

• I have read the Contributing Guide
• My code follows the project's code style
• I have added tests that prove my fix is effective or that my feature works
• I have updated the documentation accordingly
• For cosh: Lint passes, type check passes, and tests pass
• For sec-core (Rust): cargo clippy -- -D warnings and cargo fmt --check pass
• For sec-core (Python): Ruff format and pytest pass
• For skill: Skill directory structure is valid and shell scripts pass syntax check
• For sight: cargo clippy -- -D warnings and cargo fmt --check pass
• For tokenless: cargo clippy -- -D warnings and cargo fmt --check pass
• Lock files are up to date (package-lock.json / Cargo.lock)

Testing

Verification:

• npm run format - Passed
• npm run lint - Passed
• npm run test - 3717 tests passed

Additional Notes

Implementation ported from qwen-code commits:

• cdcdf85dc - Printable CSI-u keys support
• 7886ec6c8 - Unsupported CSI-u keys handling + plain text recovery
• 7b1d29432 - Sequence timeout management