Retire idle Cloud sockets after team policy changes
Closed
TE
4h ago+394+394+012345678901234567890123456789-31-31-01234567890123456789
Team policy changes left idle Cloud connections using old authority. Policy writes now commit a durable notice with the audit; CloudDO checks current shared or personal authority and closes stale connections.
Hosted checks pass 443 tests, including 18 new cases. The same wire command reproduces four failures before the fix. Live service verification is pending. Builds on #22284.
Changelog
Fixed idle Cloud connections retaining access after team policy changes.