#21322 machines: connect owner-fenced inventory and catalog discovery

Machine discovery now carries owner identity and capabilities through the daemon, Cloud models and SDKs. Admitted apps can read cached agent inventory and receive invalidations from the same owner. Stale connections and revoked access retire those watches. The Agents app remains unbundled.

Validation: 62 native inventory tests, five integration suites, all 17 SDK workflow jobs and 64 Agents tests pass. These isolated tests don't establish live Cloud or SSH behavior.

Remote relay allowlist

remote_relay/gate.rs lets identify carry machine_metadata through cmux ssh. The analysis CLAUDE.md asks for:

• Executes commands or opens local content? No. The relay intercepts Command::Identify and answers with its fixed minimal identity; the flag reaches no handler that spawns, sends keys, evaluates scripts or opens URLs.
• Mutates objects the remote doesn't own? No. identify is read-only.
• Reads local state the remote shouldn't see? No. The relay's answer still carries only app, capabilities and protocol; cmux_next_machine_identity_reader_remote_opt_in_still_reveals_no_local_state checks that the opt-in adds nothing. The Mac also never sends the flag through a relay, since HandshakeLines sends it only after machine-identity-v1 is advertised and the relay doesn't advertise it.

Changelog

Changed: Machine discovery includes owner identity, cached agent inventory and permissioned invalidations.