v2.151.4

Replace mandatory session gate with layered consent model for pulse

The pulse required a session flag file that didn't survive reboots, making RunAtLoad=true (from v2.151.3) meaningless. Now the pulse uses a layered consent model:

1. Stop flag (pulse-session.stop) — highest priority, pauses pulse
2. Session flag (pulse-session.flag) — explicit start, bounded sessions
3. Config consent (orchestration.supervisor_pulse=true) — persistent, survives reboots

With config consent enabled, the pulse runs unattended after reboot without needing aidevops pulse start.

Also includes: JSONC comment-aware config parsing, terminal escape sanitization in status output, and deduplication of consent resolution into shared config helper.

Closes #2942