chore: update .gitignore, remove tracked .pi-lens files, and sync pending changes

- Add .cache to .gitignore
- Remove .pi-lens/ from git tracking (already ignored)
- Update pi-agent-runner, pi-agent-wrapper modules
- Update claude-code agent module
- Update overlays, opencode-desktop package, and tests

modules/nixos/pi-agent-runner.nix

@@ -60,6 +60,19 @@ in
         cwd="$1"
         shift
 
+        # Parse forwarded environment variables from wrapper (KEY=VALUE)
+        while [ "$#" -gt 0 ]; do
+          case "$1" in
+            TERM=*|LANG=*|LC_ALL=*|LC_CTYPE=*|COLORTERM=*|TERM_PROGRAM=*)
+              export "$1"
+              shift
+              ;;
+            *)
+              break
+              ;;
+          esac
+        done
+
         resolve_user_policy() {
           local user="$1"
           USER_CONFIG_PATH=""
@@ -384,5 +397,34 @@ in
         ${concatStringsSep "\n" (map (arg: ''cmd+=( ${escapeShellArg arg} )'') cfg.wrapper.extraRunArgs)}
         cmd+=( "$@" )
 
-        exec "''${cmd[@]}"
+        # Reset terminal keyboard protocol modes that pi's TUI may have enabled.
+        # If pi crashes or is killed (OOM, SIGKILL, etc.), its cleanup handler
+        # never runs and the host terminal stays in Kitty keyboard protocol or
+        # xterm modifyOtherKeys mode. This causes all keystrokes to appear as
+        # raw escape sequences like ^[[99;5u (ctrl+c in CSI-u encoding).
+        #
+        # Try /dev/tty first (controlling terminal), fall back to stdout
+        # (connected through sudo to the user's Ghostty terminal).
+        cleanup_terminal() {
+          local output_dev=""
+          if [ -w /dev/tty ]; then
+            output_dev=/dev/tty
+          elif [ -w /dev/stdout ]; then
+            output_dev=/dev/stdout
+          fi
+          if [ -n "$output_dev" ]; then
+            # Disable Kitty keyboard protocol (pop all flags)
+            printf '\033[<u' > "$output_dev" 2>/dev/null || true
+            # Disable xterm modifyOtherKeys
+            printf '\033[>4;0m' > "$output_dev" 2>/dev/null || true
+            # Disable bracketed paste mode
+            printf '\033[?2004l' > "$output_dev" 2>/dev/null || true
+            # Restore cursor visibility
+            printf '\033[?25h' > "$output_dev" 2>/dev/null || true
+          fi
+        }
+        trap cleanup_terminal EXIT
+
+        # Run without exec so the EXIT trap fires after pi exits (normal or crash).
+        "''${cmd[@]}"
   ''