Render CLI sessions as read-only rows in the Duo panel inbox

What does this MR do and why?

Sessions started from the Duo CLI land in INPUT_REQUIRED as soon as the user exits the terminal, so the Duo panel session inbox shows "Waiting for input" for rows nobody can act on from the web. This MR renders those rows with a terminal icon, a CLI label and a "Read-only on the web" line instead, so the row explains itself.

Interim, frontend-only change for #627777 (closed). The CLI records the same workflow_definition as web Duo Developer sessions (developer/v1), so a session is identified as CLI by the flow version it ran: flowMetadataVersion ending in -interactive, which only the CLI's interactive developer flow uses today. The CLI /goal flow (2.0.0-goal) is excluded on purpose: it is not interactive, so its INPUT_REQUIRED is a real request. Only INPUT_REQUIRED rows get the CLI treatment; failed, finished and approval-pending CLI sessions keep their real status.

sourceType === 'CLI' is checked first so the heuristic can be deleted once #627798 (closed) records a real source type and https://gitlab.com/gitlab-org/editor-extensions/gitlab-lsp/-/issues/2836 sends it. ee/app/assets/javascripts/ai/duo_agents_platform/panel/cli_sessions.js is the single place to delete, along with the one v-if in agent_session_inbox_tab.vue that calls it.

Rather than branch inside the existing row, the shared layout moves into a new InboxRow component: the link, header line, title, and metadata line, with slots for the status content, a body line under the title, and overrides for the title, trailing, and metadata blocks. AgentSessionInboxItem and the new AgentSessionCliInboxItem each fill the status slot, and the inbox tab's row slot picks between them, so the CLI heuristic is called in one place and the row components know nothing about it. InboxRow also adds a gl-gap-2 between the row's lines.

Only the inbox's own row components change. They are reached through the inbox tab's row scoped slot, so the shared agent_flow_list_item.vue and the full-page sessions list are untouched. The inbox itself is behind duo_panel_session_inbox, so there is no user-visible change until that flag is enabled.

Follow-up MR (draft, stacked on this one): !255740 (merged) keeps these sessions out of the "Needs a decision" tab.

References

• Issue: #627777 (closed)
• Backend follow-up: #627798 (closed)
• IDLE status (the real fix): #627421 (closed)

Screenshots or screen recordings

Before	After
CLI session in INPUT_REQUIRED shows "Waiting for input"

Sessions 1 and 2 in the screenshot are CLI sessions that failed; they keep their Failed status.

How to set up and validate locally

1. Feature.enable(:duo_panel_session_inbox, User.find_by_username('root'))
2. Start a Duo Developer session from the Duo CLI (glab duo cli) against your instance, send one prompt, wait for the reply, then quit the CLI. The session is now input_required with flow_metadata_json version 2.x.y-interactive.
3. Open any project, open the Duo panel, switch to the Sessions tab, then the All tab. The session renders with the terminal icon, CLI label and "Read-only on the web".
4. A web-started Duo Developer session in the same state still shows "Waiting for input".

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.