#27104 fix(cloud): resume New Cloud Machine after sign-in once

Clicking New Cloud Machine while signed out now keeps the original creation request and destination through hosted sign-in. A successful sign-in continues once into the existing workspace wizard or requested-machine flow. Replacing the pending request, cancelling sign-in, signing out, changing account scope, closing its window, or disabling Cloud prevents stale creation.

The native action owns this handoff for the Computer menu, Add Device, and command palette. Standalone sign-in fallbacks in the agent pane and Add Device are removed so a refused action cannot silently discard the creation intent. Nonperson callers still receive the signed-out refusal.

This supersedes the native continuation portion of #24837, which predates the workspace wizard and allows multiple waiters on one browser-auth attempt to resume creation. Its CLI auto-open changes remain separate.

Requested behavior: “person-initiated sign-in then resume exact newCloudMachine once (cancel/replacement safe).”

The pending continuation has one generation; the action registry owns the sign-in work and records its network wait and failure. Replacement, sign-out, and policy teardown invalidate it; auth completion consumes it before invoking creation. The hosted sign-in attempt owns its existing timeout and cancellation.

Validation

• Exact head 101aab62316d43ca06958746aed3e05ce9b02ac4: cmux-ci step 71597d472155a75226ce8cdf finished with exit 0 on the native fleet.
• CloudSignedOutCreationContinuationTests and CloudWorkspaceSetupLifecycleTests: 19 tests passed across the two suites.
• AgentPaneConnectActionTests: 7 tests passed. Total: 26 test executions across the three filters; the account replacement test covers four cases.
• git diff --check and prepush-gate.py pass; the gate reports only the existing app-size warning. No live browser sign-in was performed; the handoff is exercised through controlled native continuations and the actual action registry.
  No capture: native action continuation and tests only; existing sign-in and workspace wizard presentations are reused.

Changelog

Fixed: New Cloud Machine continues after sign-in without requiring another click or replaying a superseded request.

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Clicking New Cloud Machine while signed out now holds the original request and resumes creation once after hosted sign-in succeeds, instead of discarding the intent or requiring another click.

• The native action runs through the action registry's effect lifecycle; ActionTrackedWork preserves deferred work and result tasks across the sign-in handoff, so post-auth outcomes surface through the registry.
• Interactive runs keep their normal failure notice, while CLI callers still capture refusals in their action result.
• The sign-in's own user-and-team hydration is allowed to finish; account or team change, stale team restoration, request replacement, sign-in cancellation, sign-out, closing the origin window, or disabling Cloud invalidates the pending creation.
• The continuation uses one generation, so a late sign-in result from a superseded attempt can never resume creation.
• Nonperson callers (for example, agents) still receive the signed-out refusal.

Migration

• Removes the multi-waiter continuation behavior from #24837; only the last person-initiated attempt resumes.