fix: allow Devin terminal capability replies

[chaodu-agent]

Summary

• add a default-on filter_terminal_responses runtime setting
• allow deployments such as Devin to opt out of DA/CPR filtering
• validate PTY_FILTER_TERMINAL_RESPONSES=true|false in the entrypoint
• preserve existing behavior for every deployment that omits the setting

Why

Devin CLI v3000.6.7 queries Kitty keyboard flags, Device Attributes, and cursor position before rendering its interactive TUI. The existing terminal-response filter passes the Kitty reply but strips DA (...c) and CPR (...R), leaving Devin stuck after login. Non-interactive --print continues to work because it does not negotiate a TUI.

Verification

• targeted config tests: 2 passed
• targeted session input tests: 2 passed
• full cargo test --locked on macmini: 150 passed, 0 failed, 2 ignored
• full-stack A/B in the same devin-648 pod:
  • filter=true on 8090: hangs after Logged in
  • filter=false on isolated 8091: workspace trust prompt and full Devin v3000.6.7 TUI render

Compatibility

The default remains true; existing Ink-based CLI protection is unchanged. A follow-up OpenAB Connect PR will emit false only for the Devin deployment variant.