#12051 Cloud sidebar: restore Desktop/VNC and Ports surfaces

Summary

Cloud machines now keep their Desktop/VNC and Ports surfaces visible and usable in the right sidebar across provider reconnects and refresh races.

• Reconciles cloud providers before catalog refreshes and resolves newly created machines on demand for Desktop and Ports opens.
• Publishes the Desktop resource before a terminal snapshot arrives and renders explicit loading, error, asleep, unavailable, and empty Ports states.
• Keeps sidebar, catalog, socket, and CLI paths on the same authenticated private-network materialization path.
• Adds the MDM DisableCloud policy across feature visibility, discovery, socket/CLI operations, provider teardown, and managed workspace cleanup.
• Adds behavior coverage for provider registration races and Desktop/Ports tree states.

The implementation favors one shared provider/catalog path over sidebar-only network calls so transport, authentication, private-network gating, and CLI behavior cannot drift. The explicit refresh may wait for authoritative provider discovery, which avoids showing a false empty tree.

Validation

• cmux vm exec vm-239f448bfd474f968de19350c4d59eee echo freestyle-terminal-split-ok succeeded in a newly opened split in workspace workspace:143.
• python3 scripts/check-package-resolved-policy.py
• python3 scripts/check-workspace-package-groups.py --check
• git diff --check
• swiftc -parse on changed Swift files.

Full Xcode app/test builds were intentionally not run per the task instruction; the existing authenticated cmux instance and Freestyle VM CLI path were used for the smoke test.

Closes #12044

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Restores Cloud sidebar Desktop/VNC and Ports surfaces so they remain visible and usable across provider reconnects and refresh races.

• Reconciles cloud providers before catalog refreshes and resolves newly created machines on demand.
• Publishes a Desktop placeholder before the terminal snapshot arrives and renders distinct loading, error, asleep, unavailable, and empty states for Ports.
• Adds the DisableCloud MDM policy: when enforced, Cloud Machines are hidden, socket/CLI commands fail, and open Cloud workspaces and providers are torn down.