#25170 cmux NEXT reducer: persist Cloud host-group removal

Problem

The sidebar's explicit Remove Remote Group choice was represented only by host_group: false, which older wires omit. New clients could therefore re-mark a removed Cloud machine when the section was replayed.

Change

• Persist host_group_opt_out in the reducer section model and wire.
• Derive the opt-out from old-client host_group patches (false sets it, true clears it).
• Advertise sidebar-host-group-opt-out-v1 so the Swift migration can gate on a daemon that preserves the field.
• Add reducer round-trip, old-client compatibility, and machine-only validation tests.

Validation

• Independent Codex gpt-6-astra xhigh source review: SHIP at 0a3d5ad88faf3e8e2339505a752e39bee8b85712 (base cffeb766121c33f7ce92227d6536964714df3e8c).
• Final-head prepush gate, rustfmt, changed-package clippy, API compatibility and protocol contract pass.
• Hosted red-before regression: 6e40bc433e2ccb4e9d0aaacb0c82c322c3241cdd, fleet step 6a0a221010507b67319bd899. Final-head host-group suite: fleet step 7ff2478e07d744765c2ef2bb (8 tests passed; predecessor fails the expected custom-section InvalidValue regression).
• release-compile-derived-data.test.sh fails identically on untouched base and this head: its stub expects -DCMUX_BENCH_HOOKS but the script also supplies -DCMUX_BLOCKING_CHECKS. No native build ran locally.

Additional full-run classification (40245963518, exact same head): Linux's failing acpmux::daemon_chat_open read-budget test, Windows bindings/rust/src/local_socket/windows.rs WSAIoctl import, and the blocking panic-ratchet findings in acpmux are outside this PR; those source and workflow inputs are unchanged from base. The full run's macOS jobs remain queued; the focused macOS fleet suite above has completed successfully. No broad rerun or workflow change was used to conceal those results.

The app FFI pin check is red by design in this Rust-only first step. check-app-ffi-pin.sh documents changing Rust, allowing app-ffi-release.yml to publish the landed feat-cmux-next SHA, then pinning the URL and checksum. Immediately after this lands, the owning lane will wait for that exact merge-SHA release and land a separate Package.swift URL/checksum-only repin PR. The structural sidebar UI PR #25121 then rebases onto the repinned base and remains held for dogfood.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Agent session: big-red