#31133 cloud: derive trigger identity from trusted scope

Cloud platform workspace machines receive a root-owned trusted turn scope but may not have the legacy Cloud bind record that normally creates an identity receipt. In that state cmux host cloud identity returned identity_unavailable, so trigger delivery could never authorize.

When the trusted scope exists and no bind is in progress, the host now creates a per-scope install key and receipt, then serves the resulting identity over the existing root-owned socket. Existing bind enrollment remains authoritative and unchanged. This lets the trigger principal bind to the platform scope while preserving key freshness across cloned scopes.

Follow-up probe: trigger-preflight must read back a delivered turn on a real Cloud machine.

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Cloud machines with a trusted turn scope but no legacy bind record previously returned identity_unavailable from cmux host cloud identity, so trigger delivery could never authorize. The host now derives identity from the trusted scope when no bind is in progress.

• The turn-scope file must be a root-owned 0600 regular file in a root-owned protected directory; malformed or untrusted files fail startup, while a missing file leaves existing machines unchanged.
• Scoped enrollment keeps its install key and receipt in separate files, so the key and receipt from normal bind enrollment are never rotated; bind-in-progress machines refuse the scoped path until normal enrollment completes.
• Only the three non-secret CMUX_PLATFORM_* fields are handed to the daemon; secret platform values are never inherited.