feat(cli): detach sandbox sessions with Ctrl-D

[drew]

Summary

Allow Ctrl-D to detach an attachment to a sandbox's canonical main process, leaving the process and stdin available for reconnection. Ctrl-P followed by Ctrl-Q continues to work.

Related Issue

Closes #3743

Changes

• Recognize Ctrl-D in the supervisor's canonical main-session input filter and close only the attachment.
• Cover input-owner and read-only viewer detachment, lease handling, and the existing Ctrl-P/Ctrl-Q sequence.
• Update CLI help, recovery guidance, published sandbox docs, architecture notes, and the public CLI skill.

Testing

• mise run pre-commit passes
• Unit tests added/updated: cargo test -p openshell-supervisor-process --lib (80 passed)
• E2E tests added/updated (not applicable to this scoped input handling change)

mise run test stopped on two supervisor-network WebSocket tests outside the changed code: plaintext_websocket_preflight_denial_does_not_connect_upstream and plaintext_websocket_middleware_inspects_compressed_ws_messages. The first received policy_denied where its assertion expected middleware_denied.

mise run ci did not pass: Go gateway-list tests observed the host's configured default system gateway where they expected empty or test-only gateway lists. These failures are outside the changed files.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3744.docs.buildwithfern.com/openshell

[johnnygreco]

Sweet, thanks @drew!