#30171 Cloud start proof: integration of #29962 and #30162 (capture only)

HOLD: capture-only integration for the Cloud start proof; it is not meant to land. Its parts land through #29962 and #30162.

feat-cmux-next at 444b31d97891 with #29962 (head 7f7b9d3e) and #30162 (head e38150ca) on top, so a fleet capture app (cmuxterm-hq pr-capture-cloud, whose provenance takes a manaflow-ai/cmux pull request head) can run Leo's flow: "whenever i start a chat it should be able to send me to cloud autommatically keep launching/downloading new dev builds and such".
Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Capture-only integration of #29962, #30162, and #30258 onto feat-cmux-next so a fleet capture app can drive Leo's flow: starting a chat on Cloud automatically and launching and downloading dev builds. This branch is not meant to land; its parts land through the individual PRs.

• DEV and dogfood builds transfer the Claude login to the creator's team machine (a team guest whose creator is the caller), including the credential-recovery restart; production still requires an owner guest.
• New compose_send and run_mode automation verbs drive the composer's Return and the run row's Cloud pick, so a chat reaches cloud.startChat instead of chat.send.
• A DEV build's legacy exec update takes its pin from a new cmux link machine pin command, and a chat copy refused by the machine's outdated daemon is retried after the update on the machine's new link — the daemon restarts, so the retry waits up to 90 s for the new socket instead of failing on the stale one.
• The Cloud start reads its cached Claude login with security find-generic-password -w (30 s bound) instead of SecItemCopyMatching, whose macOS permission prompt never gets answered on a headless capture runner and stalls the start on "Clone repository".