#11626 Cloud VPC follow-ups: copyable machine IPs, working tree menu, no HTTP modal on private addresses

Follow-ups to #11602 (merged before these landed on the branch):

Copy IP Address + VPC rule heal (45de39a40a)

• Machines record their private-network addresses at create; GET /api/vm returns address: {ipv4, ipv6}, the socket vm.list payload passes them through, and the sidebar machine menu gains Copy IP Address (v4 preferred, v6 fallback, en/ja localized). Machines created before address recording backfill on their next attach — the driver already reads vm.data() there.
• ensureNetwork now verifies the VPC's members-reach-each-other rule (all ports — it carries the whole feature) on every reuse and re-creates it if deleted out of band. Best-effort, so a transient listing failure never blocks a create.

The cloud tree context menu never dispatched a click (d237e7f07c)

Pre-existing since the menu shipped: the item action selector perform(_:) compiles to perform:, colliding with NSObject's perform machinery, so AppKit dropped every click — Rename, Checkpoint, Delete, all of it. Renamed to execute (the shape SidebarRowMenuActionItem proved) and moved presentation to the per-event menu(for:) path with autoenablesItems = false, matching every working cmux menu. Debug probes stay in so the next menu regression is one log read away.

Plain-HTTP warning skipped for private-address literals (fd8b63f235)

The modal's rationale — traffic can be read or modified on the network — is about the public Internet; RFC 1918, link-local, and IPv6 unique-local literals never cross it, and cmux Cloud machines live at exactly those addresses (VPC ULAs reached through the user's WireGuard tunnel, encrypted end to end). Public HTTP keeps its warning; names never qualify, only literals, so DNS can't smuggle a bypass.

Verified

• Live dogfood on the local stack: Copy IP puts 10.16.133.3 on the clipboard; http://10.16.133.3:<port> opens with no modal; port-8811 listener reachable over the tunnel (all-ports rule).
• 19 focused Swift tests green (menu/tunnel/allowlist suites), 112 affected web tests green, tagged Debug build clean.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Improves several Cloud VPC dogfooding gaps across networking and the sidebar. Reused VPCs also recover missing connectivity rules instead of silently losing member access.

Networking

• GET /api/vm and vm.list expose private IPv4/IPv6 addresses for Copy IP Address; older machines backfill them on their next attach.
• Port rows display scheme-free links, copy full URLs, open browser panes, and use <label-or-id>.internal when available.
• Adds cmux vpn hosts, syncs a managed /etc/hosts block on vpn up, and removes only that block on revoke.
• Reused VPCs best-effort recreate the all-ports members-reach-each-other rule; RFC 1918, link-local, and IPv6 unique-local literals skip the HTTP warning while public hosts still warn.

Sidebar and UI

• Cloud context-menu clicks now dispatch and select the clicked row; workspace rows use friendly machine names, compact single-child folder chains, and show only orphaned terminals.
• Terminal and port actions focus the opened tab, and terminals open as tabs instead of new split columns.
• Closing tabs no longer prompts; the Cloud VM split button and ui.newWorkspace.menuSectionOrder setting are removed.

Summary by CodeRabbit

• New Features

  • Added Copy IP Address for machines with private-network addresses.
  • Added Copy Link for port entries.
  • Added cmux vpn hosts to synchronize internal VM hostnames in /etc/hosts.
  • Added Japanese localization for the new action.
  • Cloud terminal and workspace actions now open in tabs.

• Bug Fixes

  • Private and link-local addresses no longer trigger plain HTTP warnings.
  • Context menus select the clicked row and show relevant actions.

• Changes

  • Removed the Cloud VM split-button and related new-workspace menu options.