Attach Remote keyboard injection to approved controlled sessions

Local launch and managed startup now start the incoming-key owner for
sessions installed with keyboard-inject, using one input-helper
Supervisor retained for the reader lifetime. Delivery rechecks lock,
XTerm handoff and internal reader UI in addition to lease, grant and
deadline. build-cthulhu.sh and both Arch packages build and install
cthulhu-input-helper; a missing helper leaves keyboard input
unavailable without affecting startup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_build_script.py

@@ -99,16 +99,17 @@ class BuildScriptTests(unittest.TestCase):
         self.env["GOTOOLCHAIN"] = "local"
         result = self.run_build("--output-dir", "output directory", "--", "-trimpath")
         self.assertEqual(result.returncode, 0, result.stderr)
-        for binary in ("cthulhu", "cthulhu-braille"):
+        for binary in ("cthulhu", "cthulhu-braille", "cthulhu-input-helper"):
             self.assertTrue((self.caller / "output directory" / binary).is_file())
         builds = [call for call in self.calls("go") if call[1][0] == "build"]
-        self.assertEqual(len(builds), 2)
+        self.assertEqual(len(builds), 3)
         for call in builds:
             self.assertIn("-trimpath", call[1])
             self.assertEqual(call[2], str(self.project))
             for name in ("GOTOOLCHAIN", "GOFLAGS", "CGO_CFLAGS", "GOMODCACHE"):
                 self.assertEqual(call[3][name], self.env[name])
         self.assertIn("brlapi", builds[1][1])
+        self.assertNotIn("brlapi", builds[2][1])
         self.assertFalse(self.calls("curl"))
 
     def test_old_go_bootstrap_and_cache_reuse(self):
@@ -120,7 +121,7 @@ class BuildScriptTests(unittest.TestCase):
         result = self.run_build()
         self.assertEqual(result.returncode, 0, result.stderr)
         self.assertEqual(len(self.calls("curl")), 2)
-        self.assertEqual(len([c for c in self.calls("bootstrap-go") if c[1][0] == "build"]), 4)
+        self.assertEqual(len([c for c in self.calls("bootstrap-go") if c[1][0] == "build"]), 6)
 
     def test_checksum_failure_never_executes_download(self):
         self.env.update(INSTALLED_GO="1.20.14", ARCHIVE_SHA="0" * 64)