fix(terminal): repair fallback job control and prepare remote human input (ALL-143)

[allisoneer]

The portable supervised PTY fallback redirected Bash fg stderr to /dev/null, leaving the supervisor and requested interactive shell stopped in a background process group on macOS Bash 3.2. Keep stderr attached while retaining stdout suppression, and prepare human-only CLI construction with ssh -e none and podman exec --detach-keys= so transport escape/detach sequences cannot consume human input.

This draft depends immediately on ALL-141 / #352 (codex/all-141-browser-terminal, base a87fd5d3f22c892723d0e6eb4e3492147ede380f) and is a sibling of ALL-142 and ALL-144. Model launch flags, TERM/pager/environment defaults, selected backend, credential filtering and cleanup authority remain preserved. The foreground fix deliberately applies to existing model PTYs using the same broken fallback. Pipe invocation and the Linux setsid -w branch are unchanged.

Human SSH/Podman admission remains rejected in both permission and manager boundaries. ALL-143 is incomplete: no disposable Linux SSH target was assigned and the existing Podman VM is stopped. Real controlling-terminal fidelity, SSH/Podman byte pass-through, full-screen apps, remote/browser reload and backend outage/restart acceptance remain unverified; the draft does not advertise remote human support. docs/terminal-remote-qualification.md records the exact remaining fixtures and infrastructure authorization required.

Validation:

• make setup passed in the isolated managed worktree.
• cargo test --locked -p nac-core --lib -- --test-threads=4: 1,552 passed, 0 failed, 9 existing infrastructure-dependent tests ignored.
• Final cargo test --locked -p nac-core remote_pty_tests -- --test-threads=1: 2 passed. A bounded real local PTY regression forces fallback and exercises monitor mode, 24x80→31x91 geometry, UTF-8/ANSI, Ctrl-C, Ctrl-Z/bg and a separate-job-group background descendant cleanup. Descriptor closure/reaping is bounded and failed cleanup retains authority.
• Added manager regression rejects unqualified SSH/Podman before spawning and preserves the selected backend without falling back to Local.
• Locked cargo check, strict production cargo clippy --locked -p nac-core --lib --bins -- -D warnings, cargo fmt --all -- --check, staged diff check and make test-source-size passed.

No dependencies, generated API/assets, VM state, external host/container services, or common-branch files changed. No final independent PR review has been spent yet.