#28788 Cloud: recognize machine creators on shared teams (main)

The creator of a Cloud machine now gets vmKind: "owner" on shared teams of any size. Other members still receive team; an unread, failed, timed-out or missing member list also stays team. This changes the caller-specific attach answer, leaving teammates' access and the guest-wide kind alone.

Leo, verbatim: "yeah let's just go ahead we need to not worry that much about these and just get the initial end to end flows working and working well adn looking good and feeling good".

Generalizes #28479's one-member rule; prior art #26222 and #20076 define the separate caller and guest answers. This targets main because web/ deploys from main; companion #28789 keeps feat-cmux-next in step and updates its backend caller answer.

Risk: the caller-specific owner answer permits that creator's session to opt out of the local sandbox even when teammates can reach the machine, as authorized above. Membership errors still fail to team.

Tests cover the creator remaining owner when the team grows from one to three members, another member receiving team, a creator leaving the team, and existing error/timeout cases, through both attach transports and the pure classifier.

Observed / Not run

• Observed: scoped verify-local feature flag check and diff whitespace check pass.
• Linux run 41160302819 at 88ac12c22a2197596cb8d00e4e8704cd06b8aac5: restoring the old one-member condition makes bun test tests/vm-attach-vm-kind.test.ts fail on the shared-team creator cases. Restoring the head passes that same file. The combined command bun test tests/vm-attach-vm-kind.test.ts tests/vm-route-auth.test.ts passes all 119 tests; ESLint on changed logic/tests, bun run typecheck, and bun run lint:complexity pass.
• Independent gpt-6-astra review at this exact head: SHIP, no findings (receipt).
• Not run: live Cloud machine attach. No UI layout changes.

Changelog

Fixed: Cloud machine creators are recognized as owners on shared teams.

Agent session: agent session