feat(macos): release keyboard grab on lock screen and user switch

[FlameFlag]

Address #1743

Poll CGSession state from a small background thread and pause kanata's
global IOKit grab whenever the screen locks or kanata's session loses
the console. Resume the grab once the session recovers

Key the fast-user-switching check on kCGSSessionOnConsoleKey, since
CGSessionCopyCurrentDictionary returns the caller's session — a
username comparison against a launch-time snapshot would never trip.
Read the undocumented CGSSessionScreenIsLocked boolean for the lock
signal. Fall back to "do not pause" on a NULL dict so root LaunchDaemon
installs (no Quartz GUI session) keep working

Re-check the pause flag right after kb.read() returns, not just at the
top of the loop. wait_key blocks on a read(2), so the typical lock
path catches kanata mid-read with the new user's first keystroke already
seized by IOKit. Drop that event without remapping or emitting it —
trade one lost keystroke for never producing a wrong one

Checklist

• Add documentation to docs/config.adoc
  • N/A
• Add example and basic docs to cfg_samples/kanata.kbd
  • N/A
• Update error messages
  • N/A
• Added tests, or did manual testing
  • Yes, Manual

[FlameFlag]

@jtroo I resolved the conflict

[FlameFlag]

Resolved again

[jtroo]

The approach looks sensible to me.

I think this needs to be configurable though. I presume there are users who are the sole users of their machines that prefer the current always-grab even on lockscreen behaviour - without configurability this change would break their workflows. The default should IMO preserve the current behaviour.

With respect to implementation, a CLI argument seems more fitting for this type of functionality as opposed to a config item, but that is a weakly held opinion.

[FlameFlag]

Yea, I was thinking the same some time after I made the PR, does --release-grab-on-lock sound good?

[jtroo]

Name sounds good!

[jtroo]

Thanks!