fix(cli): restore terminal from cbreak mode after run exits

[hertznsk]

Summary

Fixes #290 — Conductor could leave the invoking terminal in cbreak mode (no echo / no line editing) after a workflow exited, requiring a blind reset or stty sane to recover.

Root cause

KeyboardListener.start() captured the tty settings on every call. Under specific interleavings — a second listener instance in the same process, or a second start() on an already-active listener — the captured "original" settings were the already-broken cbreak state, which stop() then faithfully restored. Additionally, provider cleanup could alter terminal settings after listener.stop() had completed, and the SIGTERM handler swallowed the signal, leaving the process running.

Changes

• Process-global baseline: Capture the tty baseline once per process into a module-level cache before the first tty.setcbreak(); every later listener instance reuses it instead of re-snapshotting the live tty.
• Idempotent start: Make start() idempotent while the listener is truly active (baseline held AND reader thread running), so a duplicate call can't overwrite the baseline or spawn duplicate threads. Start-after-suspend() still restarts correctly.
• Robust restore: Restore with TCSANOW instead of TCSADRAIN so a blocked output drain can't delay the restore.
• Retry capability: Clear the saved baseline only after a successful tcsetattr, so a transient restore failure can be retried by atexit/SIGTERM/stop().
• SIGTERM correctness: The SIGTERM cleanup handler now delegates to the previously-installed disposition after restoring: SIG_DFL resets and re-raises via os.kill, SIG_IGN stays ignored, a callable previous handler is invoked. The previous disposition is captured into the handler closure at registration time to prevent infinite self-recursion.
• Outermost teardown protection: The run and resume commands now reapply and retire the process baseline at their outermost cleanup boundary (after provider shutdown and all other teardown steps). This ensures that even if a provider's cleanup puts the terminal back into cbreak, normal exit, Ctrl+C, and late cleanup failures all return a sane terminal to the shell.

Tests

• New real-pty integration tests (tests/test_interrupt/test_listener_pty.py) reproduce both corruption scenarios on a genuine pseudo-terminal: two listener instances in one process, and double-start() on one instance.
• CLI boundary real-pty tests (tests/test_interrupt/test_cli_terminal_pty.py) verify that provider teardown cannot bypass final TTY restoration, that a later non-interactive run doesn't reuse an old TTY baseline, and that the real CLI restores exact TTY attrs on exit and Ctrl+C.
• New mocked unit tests for the baseline cache, idempotent start, TCSANOW restore paths, restore retry semantics, all SIGTERM delegation cases, and process baseline restoration after listener stop.
• Full suite passes; make lint and make typecheck clean.

Scope

• src/conductor/interrupt/listener.py
• src/conductor/cli/run.py
• Tests in tests/test_interrupt/
• CHANGELOG.md

No behavior change for suspend()/resume() semantics. Windows is unaffected (the listener is already Unix-only).