#26563 fix(next-auth): preserve sessions when Keychain is temporarily unavailable

HOLD: Land after #25759 (fix/25665-auth-review-followup) adds FallbackTokenStore.isTokenStorageAvailable() to the shared auth runtime and that API is present on feat-cmux-next.

NEXT’s CloudAuth currently constructs the shared protected Keychain/file fallback but leaves AuthCoordinator.isTokenStorageAvailable at its default { true }. A transient Keychain-unreadable result can therefore look like an empty store during NEXT restore and clear the cached signed-in session. This downstream patch wires the existing availability hook to the fallback store. It deliberately contains no Keychain policy, token-store, SDK, or classic composition changes; #25759 owns those.

Validation: python3 scripts/cmux-next/prepush-gate.py passed; git diff --check passed. The Swift package cannot compile this branch until #25759’s shared API is merged/synced. After that dependency lands, run the focused CmuxAuthRuntime availability tests plus CmuxNextAppTests auth restore coverage on this exact commit rebased onto the dependency.

Leo’s onboarding ask applies: “Also, we need to be fixing authentication issues, like the whole onboarding situation. Is that in? What does you improve? What does you fix? The edge cases, like you guys need to comprehensively brainstorming all the onboarding edge cases: foot guns, paper cuts, snags, clips, whatever the f***.”

Risk: high (authentication session persistence). No UI change and no capture required.

agent-identity footer --repo manaflow-ai/cmux

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes NEXT sessions being cleared when the Keychain is temporarily unreadable (for example, before first unlock). CloudAuth now forwards the fallback token store's availability to AuthCoordinator, so a transient Keychain error is treated as an unavailable store instead of an empty one, and the cached signed-in session survives restore.

• Capture fixture builds always report storage as available; both production branches forward FallbackTokenStore availability.
• Depends on FallbackTokenStore.isTokenStorageAvailable() from #25759 and should land after that merges.
• High risk because it affects session persistence; no UI change.