feat(boxen): C M5 #813 -- input_decoder Kitty keyboard protocol enable + CSI-u decode

[jsavin]

Summary

Implements milestone M5 of the Phase C input decoder per
planning/phase_c/INPUT_DECODER_PLAN.md section 7. M5 adds Kitty
keyboard protocol support for terminals that advertise it; terminals
that do not (Terminal.app, iTerm2) silently ignore the enable and the
M2 CSI parser continues to handle their input.

• input_decoder_kitty_enable() writes \x1b[=1u (progressive
  enhancement: disambiguate escape codes) to tty_fd when tty_fd >= 0.
  Idempotent so duplicate enables do not pile up writes. Test-seam path
  (tty_fd == -1) still records the bit only.
• decode_csi() gains a case 'u': that decodes the two-part CSI-u
  form (\e[KEYCODE u and \e[KEYCODE;MODIFIER u) to boxen_event_t.
  Functional keycodes (9 Tab, 13 Enter, 27 Escape, 127 Backspace) route
  to the matching BOXEN_KEY_*; printable keycodes pass through as
  ev.key.ch with C0/C1/surrogate/out-of-range rejection so the CSI-u
  surface does not smuggle control bytes that the standard CSI path
  already filters.
• Six new behavioral tests (un-skips the M5 SKIP stubs and adds a
  burst round-trip): A, A+Alt, Enter+Ctrl, Escape+Alt, lowercase a,
  and a three-event inject combining bare + modified forms.

Probe-and-read for the terminal's kitty acknowledgement is deferred
to M6 where the real read(2) loop lives. M5 ships only the decoder's
ability to handle CSI-u when it arrives, per the milestone scope in
plan section 7.

Out of Scope (Deferred)

• M6: cutover that replaces tb2_poll_event with input_decoder_poll
  and runs the kitty probe-and-read.
• M7: /mouse toggle slash command.
• Three-part CSI-u form (KEYCODE;MOD;EVENT u) -- post-launch.
• Extended functional keycode table (arrows, F-keys via CSI-u).
  Kitty terminals already emit these via standard CSI in the
  no-progressive-enhancement mode; M5 supports the subset needed
  for the M5 acceptance tests.

Test Plan

• Unit tests: 955/955 (was 953 pre-M5; +1 from un-skipping stubs,
  +1 net from the burst round-trip test)
• input_decoder_tests: 129/129 passing, 0 SKIP stubs remaining
• M2/M3/M4 regression: no test failures introduced
• Integration suite (running)
• /gate review

Plan reference: section 3.9 (protocol), section 4.3 (state machine
extension), section 7 (M5 scope), section 6.2 (M5 coverage row).

Closes #813

[jsavin]

Gate Review: phase-c-m5-kitty-protocol (PR #820)

Verdict: PASS WITH NOTES (addressed in gate-fix commit)

Tests

• unit passed (964/964 at HEAD)
• integration passed (21-failure baseline matched; failures unrelated to input_decoder)

Reviewers

• bar-raiser ran (always)
• security ran (always; binary parsing + TTY write surface)
• concurrency ran (auto: matched path frontier-cli/**)
• swiftui skipped (excluded; pure C codebase)

---

P0 -- Blocking

None.

P1 -- Important

None.

P2 -- Polish (addressed in this PR)

#	Finding	File	Flagged by	Resolution
1	CSI-u rejection branches (no-keycode, zero, C0, C1, surrogate) had no test coverage. A regression that started emitting events for these inputs would slip past CI until a user-facing symptom surfaced.	tests/input_decoder_tests.c	bar-raiser, security	Added six negative-path tests asserting BOXEN_ERR_TIMEOUT + a +1 bump on parse_errors for each rejection branch.
2	C1 control range fence (keycode < 0xA0) had no boundary pin. A regression that moved the boundary by one would not fail any test.	tests/input_decoder_tests.c	bar-raiser	Added paired tests for \e[128u (reject) and \e[160u (NBSP, accept) to pin both sides of the C1 fence.
3	Functional-key modifier path (Tab+Alt, Backspace+Shift) had no explicit coverage; only Enter+Ctrl and Escape+Alt were tested.	tests/input_decoder_tests.c	bar-raiser	Added \e[9;3u (Tab+Alt) and \e[127;2u (Backspace+Shift).
4	input_decoder_kitty_enable idempotency contract was implemented but had no behavioral test pinning the "second call is a no-op" invariant.	tests/input_decoder_tests.c	bar-raiser, security	Added test_kitty_enable_idempotent which calls the function twice and asserts the bit stays set without observable side effect (test-seam suppresses the would-be duplicate write).

Bar-raiser observations (no action required)

• The > 0x10FFFF upper-bound check inside the CSI-u path is unreachable under the current csi_parse_params saturation cap of 100000; documentary defense, fine to keep.
• The 'u' case body is ~80 lines including comments; extracting decode_kitty_csi_u() would mirror the helper pattern used by decode_sgr_mouse / decode_ss3. Not blocking -- the case is self-contained and well-commented in its current location.

Security observations (no action required)

• kitty_enable write payload is a static const string ("\x1b[=1u", 5 bytes); no format strings, no user data, no injection surface.
• The 5-byte write is well within PIPE_BUF guarantees on macOS/Linux; partial-write handling is not required and the rationale is documented at the call site.
• Idempotency guard prevents enable-sequence floods if the slash command is spammed.
• All decoder rejection paths bump parse_errors, providing an observable signal for protocol-rejection (complement of dropped_bytes for back-pressure rejection).

Concurrency observations (no action required)

• kitty_enable adds a write(2) to tty_fd. The single-owner + GIL-held contract from input_decoder.h lines 27-39 covers this; the new call site is no riskier than the existing input_decoder_set_mouse write path (lines 409-417).
• The new decode_csi 'u' branch is pure in-memory dispatch; no new globals, no new threading surface.
• No changes to the M2 langbackgroundtask-style yield model.

Stats

• Files reviewed: 3 (input_decoder.c, input_decoder.h, input_decoder_tests.c)
• Findings: 0 P0, 0 P1, 4 P2 (all addressed in this PR's gate-fix commit)
• Reviewers ran: 3 of 4 configured (swiftui excluded per project config)
• Tests: 964/964 unit, integration matches 21-failure baseline