fix(console): host-side PTY via script(1) so the host shell has a named tty and a controlling terminal

The PTY the agent allocates lives in the sandbox's devpts; on the host the
forwarded fd cannot be named (`tty` fails, no controlling terminal, tools
that open /dev/tty break). script(1) gives the login shell a host PTY and
relays through the forwarded one. Also picks up upstream main (frame-burst
fix).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018jkHZhr7ZzHGGuE2bJQmGa

host-shell.sh

@@ -9,9 +9,18 @@
 # The inner resolution runs ON THE HOST: flatpak-spawn forwards the sandbox
 # environment, so $SHELL would still point at this script — resolve the user's
 # real login shell from passwd instead and fix up $SHELL before exec'ing it.
+#
+# The PTY itself was allocated inside the sandbox (its own devpts instance),
+# so on the host the forwarded fd cannot be named (`tty` fails, no
+# controlling terminal, tools that open /dev/tty break). script(1) allocates a
+# second, host-side PTY for the shell and relays through the forwarded one;
+# util-linux >= 2.35 also passes window-size changes along.
 exec flatpak-spawn --host /bin/sh -c '
     shell="$(getent passwd "$(id -un)" | cut -d: -f7)"
     [ -x "$shell" ] || shell=/bin/sh
     export SHELL="$shell"
+    if command -v script >/dev/null 2>&1; then
+        exec script -q -e -c "exec \"$shell\" -l" /dev/null
+    fi
     exec "$shell" -l
 '

scripts/make-flatpak.sh

@@ -73,4 +73,4 @@ flatpak build-update-repo repo --title="HeiniRemote Agent" --prune --prune-depth
 
 echo ">> done: ./repo"
 
-# Touched to trigger a rebuild against upstream eac11e0 (2026-09-21).
+# Touched to trigger a rebuild against upstream f8c509b (2026-09-21).