feat(cloud): activate the root-owned Native guest receiver
Backend routing (answers the earlier P1 that cmux-api's http.ts and CloudDO don't serve the receiver ops): since #30401, development's cmux-api forwards every cloud:CloudDO op on /v1/ops and /v1/read to cmux-platform-development (backend/apps/api/src/platform-forward.ts, PLATFORM_SURFACES=cloud). That includes cloud.vm.network_policy and cloud.vm.receiver.lifecycle, which this PR adds to @cmux/protocol with owner cloud:CloudDO. The platform CloudDO serves them in cmux-platform#350, which cmux#30399 backs. cmux-api's own CloudDO serves them nowhere, and it doesn't need to: the receiver only turns on with cmux host run --native-receiver, and that flag ships only in the dedicated development native_receiver image. Staging and production never receive that image. Landing this PR is inert until that image is baked. The fresh-machine receiver check runs after #30399 and platform#350 land.
Merge carry (claude-13): merged feat-cmux-next. Harness-login's JsonPoster::get and send (GET/PUT with a bearer) now go through the bounded Transport with an explicit method. request_with_deadline still refuses a bearer on GET for policy and keyset reads. The github_repos test fake returns the enrollment fields that the typed token check requires.
Fresh Native-backed Cloud machines currently have no production guest receiver: cmux host run does not activate the private root-owned receiver stack. This ports the receiver authority/lifecycle, token verification and bounded stream machinery from the audited prior-art stack through #22837 onto current NEXT, and adds explicit root-only cmux host run --native-receiver activation. Existing host invocations retain lifetime-only behavior. The newer GitHub credential and hand-off request handling is preserved.
The guest uses the original bound VM identity for cloud.vm.network_policy, cloud.vm.receiver.lifecycle and keyset reads. Signed v2 receiver generations, bounded policy leases, suspend-aware deadlines and owned child drain prevent old authority from surviving restart or revocation. Current Worker-signed vmk owner/team claims are validated and bound to the daemon connection; missing legacy claims never imply ownership. Verified Native owners receive an explicit first-chat command allowlist for handshake, workspace/agent-tab provisioning, inventory and session operations. Every request rechecks the signed role, live remote principal and host policy; team, missing-role and legacy remote callers retain their denials. The GUI terminal command path is explicitly admitted for owned PTY attachments, with connection and lease checks and only the GUI’s exact latest size-policy shape. No classic web API fallback is introduced.
This deliberately keeps the prior-art security state machine and its tests together; most of the large diff is existing receiver code and generated protocol bindings, with current-source compatibility repairs. Prior art includes #22433, #22524, #22534, #22544, #22545, #22548, #22553, #22558, #22579, #22690, #22799 and #22837. It supersedes none of their branches and preserves their designs.
Validation: generated Rust/TypeScript bindings match; scoped NEXT prepush gates, diff whitespace and manifest parsing pass. Receiver library suites passed at 3f535d4f2726 (https://github.com/manaflow-ai/cmux/actions/runs/41173132007). All 15 privileged receiver cases actually executed and passed at the same head (https://github.com/manaflow-ai/cmux/actions/runs/41173079837): root/work-user boundaries, encrypted daemon traffic, process inspection, host CLI activation and original-policy generation/retirement. Independent review is SHIP at final 4398cd6567d445bbc721045ee52ec87a8a132d73 (https://github.com/manaflow-ai/cmux/pull/28947#issuecomment-6539916701). Its combined fleet run https://github.com/manaflow-ai/cmux/actions/runs/41173873896 passed libraries, then found a test-only transfer-host module reference error; 4398cd6567d4 fixes that reference. The exact-ref controller test of the NEXT-derived final head is pending at https://github.com/manaflow-ai/cmuxterm-hq/actions/runs/41175171011, not green.
Added security cases cover signed-role request tampering, 5,000 dropped/rejected handshakes followed by admission/revocation, production-entry handshake → workspace/agent tab → trust/start/attach, and terminal input/output/resize/snapshot/detach with foreign-lease, browser, role and revocation negatives.
Deployment requires matching Native/CloudDO backend operations, matching app/client support, a rebuilt guest binary and a newly baked Native image with the opt-in flag. See docs/cloud-native-receiver.md. Existing machines are not upgraded or adopted by this PR.
Agent session: agent session