cmux-host: verify fresh enrolled identity for Cloud triggers
Cloud trigger tokens need to bind to the receiving machine after snapshot restore. A copied status file or machine ID cannot establish that identity.
Adds cmux host cloud identity and cmux_host::identity::query(). The system host accepts the request before reading provider metadata through its existing sole reader, then checks its settled identity against the current install key and a receipt written only after successful Cloud enrollment. It returns machine, provider instance and SHA-256 of the existing P-256 public key DER SPKI. The Unix client verifies root peer credentials, uses a fixed socket, and bounds reply size and total read time. No credential leaves the host.
Requested behavior: “an agent principal: a scoped, short-lived trigger token minted per trigger and bound to its owner.” This PR supplies the independent receiving-machine identity for that token.
Security limits: this query is a point-in-time observation, not an authorization lease. Trigger callers must recheck after asynchronous work and before mutation, and abort stale operations. This change does not claim inherited acpmux processes stop or that an operation already executing during a memory snapshot is atomic. Old guests without a successful enrollment receipt fail closed for this new capability; existing attach/chat paths are unaffected. Root compromise remains outside the local boundary. See docs/cloud-trigger-identity.md.
Validation: focused unit coverage includes same-instance resume, clone/key mismatch, stale or missing enrollment, failed metadata, identity transition, peer identity rejection, oversized replies and a slow-byte deadline. Fleet cmux-ci test and clippy are being dispatched at this head; results will be recorded before landing. Static prepush checks pass. Broad verify-local finds existing localization debt and missing CmuxDeviceHub workspace grouping; no Swift or project files change.
Prior art read: #30318 (login sync, separate bind seam), #28761 (whole-request deadline and bounded replies retained), #25039 (existing enrollment credential boundary), #26863 (no credential export), #25682 (snapshot trajectory restore). No UI change.
Agent session: agent session