fix(container): harden shell terminal keybinds for Docker-attached panes

Disable signals that cause problems in Docker-attached terminals:
Ctrl+Z (suspend closes pane), Ctrl+S/Q (flow control freeze),
Ctrl+W (Windows Terminal close-tab conflict). Rebind SIGQUIT and
EOF to esoteric combos for emergency use.

Author: AnExiledDev

container/.devcontainer/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+### Terminal
+
+- **Shell terminal keybinds hardened** — disabled `Ctrl+Z` (suspend, which closes Docker-attached panes), `Ctrl+S/Q` (flow control freeze), and `Ctrl+W` (conflicts with Windows Terminal close-tab). Rebound `Ctrl+\` (SIGQUIT) to `Ctrl+]` and `Ctrl+D` (EOF) to `Ctrl+^` as emergency-only alternatives.
+
 ### Hermes Agent
 
 - **New feature: `hermes-agent`** — installs [Nous Research's Hermes Agent](https://hermes-agent.nousresearch.com/) CLI via the upstream `curl | bash` installer with `--skip-setup`. Hermes uses the plain `anthropic` / `openai` Python SDKs directly and supports any compatible provider (Anthropic, OpenAI, MiniMax, local models). Enabled by default; set `"version": "none"` in `devcontainer.json` to disable.

container/.devcontainer/scripts/setup-aliases.sh

@@ -108,6 +108,20 @@ if [ "\$TERM" = "xterm" ] || [ -z "\$TERM" ]; then
 fi
 export COLORTERM="\${COLORTERM:-truecolor}"
 
+# Terminal keybind hardening — disable signals that cause problems in
+# Docker-attached panes (suspend closes pane, flow-control freezes
+# terminal). EOF and QUIT rebound to esoteric combos for emergency use.
+stty susp undef      # Kill Ctrl+Z — suspend closes Docker-attached panes
+stty -ixon           # Kill Ctrl+S/Q — flow control freezes terminal
+stty werase undef    # Kill Ctrl+W — conflicts with Windows Terminal close-tab
+stty quit '^]'       # Rebind Ctrl+\ (SIGQUIT) → Ctrl+] (emergency only)
+stty eof '^^'        # Rebind Ctrl+D (EOF) → Ctrl+^ (emergency only)
+# zsh bindkey cleanup — stty handles the terminal layer, but zsh's line
+# editor has its own Ctrl+W binding that bypasses stty
+if [ -n "\$ZSH_VERSION" ]; then
+    bindkey -r '^W'  # Remove backward-kill-word (stty werase already disabled)
+fi
+
 # Native binary (installed by claude-code-native feature)
 _CLAUDE_BIN="\$HOME/.local/bin/claude"