sessions: vault discovery tools, shared stdin, ctrl-key fixes

New sessions/session_export tools plus a sessions_block vault map in the system prompt (tai.py, ported to detz); recall/search carry a session footer instead of letting the model grep sealed bytes. write_file refuses new markdown at working/repo roots, and the blanket *.md gitignore is gone so docs stay visible. One LineInput owns fd 0 for every prompt (ask, approvals, shell_ask, secrets), ending phantom-empty answers; Ctrl-C re-prompts (double exits), Ctrl-D exits, Ctrl-Z suspends; mid-turn Ctrl-C announces itself and kills foreground shell children via RunInterrupted. Covered by SessionsTests, repl_keys.py pty checks, agent_diff sessions_block cases.

taicpp/tests/agent_diff.py

@@ -186,6 +186,7 @@ EXPECT = {
     "utf8_replace": lambda text: text.encode("latin-1").decode("utf-8", "replace"),
     "orientation_block": lambda directory, sandbox: tai.orientation_block(directory or None, sandbox),
     "capability_block": lambda yolo, auto: tai.capability_block(yolo, auto),
+    "sessions_block": lambda home, profile: tai.sessions_block(home, profile),
     "split_leading_tags": lambda text: list(tai.split_leading_tags(text)),
     "expand_file_mentions": lambda text, directory: tai.expand_file_mentions(text, directory),
     "profile_ok": lambda s: bool(tai.PROFILE_RE.match(s)),
@@ -448,6 +449,9 @@ def build_cases(rng, fuzz):
     add("orientation_block", "", True)
     add("orientation_block", HOME, False)
     add("orientation_block", "/nonexistent/dir/../x", False)
+    add("sessions_block", HOME, "default")
+    add("sessions_block", HOME + "/", "work")
+    add("sessions_block", "/nonexistent", "t")
     workdir = tempfile.mkdtemp(prefix="agent-diff-work-")
     with open(os.path.join(workdir, "a.txt"), "w") as handle:
         handle.write("x")