#30434 Cloud: bind repository tools to the chat session

Leo asked for “this kind of recovery” when attaching a repository to a Cloud chat.

Repository agent tools now require the protected chat ID to match the caller authenticated by the acpmux initialize handshake. The tool environment includes the caller ID, and daemon actions reject a presented ACP launch credential targeting another chat.

Follow-up 1 to #30361, plus installation-link hardening from the recovery review. Every link source now uses one HTTPS/github.com validator, and a valid Mac-synced link takes precedence over connector and seed responses. Unsafe links never become card destinations; a bad seed link still consults the connector so a valid cached link can recover. Existing same-user local CLI access and authenticated Mac links remain authorized; this change binds presented agent identities, without claiming raw same-UID sockets isolate processes. Tests cover missing/forged tokens, immutable first-initialize binding, foreign chat refusal before CLI execution, and local/remote routing.

Validation: Rust fleet checks pending; formatting and static prepush pass.

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Follow-up to #30361 that binds Cloud repository agent tools to the chat session proven by the acpmux initialize handshake. Repository tool calls now require the acpmux caller to match the chat session; missing or mismatched callers are refused before any CLI runs. The first-initialize binding is immutable, daemon actions reject an ACP launch credential targeting another chat, and CLI calls attach a launch credential that routes them back to their originating session.

Installation-link hardening

• One validator checks every link source for HTTPS, the exact github.com host, no credentials or non-default port, and no control characters.
• A Mac-synced link takes precedence over connector and seed responses; unsafe links never become card destinations.
• A bad seed link still consults the connector so a cached valid link can recover.
• Old stored unsafe links are ignored when read, and stale unsafe cache data falls back to a validated connector link.

Merged from the base branch: the Cloud start-chat checklist was reverted (clone and setup progress fields removed), attached repository rows in Cloud Session Info are deduplicated, and the Cloud repository UI and recovery are localized. Tests cover missing and forged tokens, immutable binding, foreign-chat refusal before CLI execution, and unsafe link rejection across every recovery path.