#32052 Cloud: cmux cloud start-session gives its machine the Claude login

cmux cloud start-session --agent claude started Claude on a Cloud machine that had none of the person's Claude login, so every turn answered "The provider rejected Claude Code's credentials on this Cloud machine." This happened even in a run whose app held the login: the cmuxterm-hq cloud-start-session capture (run 41415284694, with claudeLogin set by cmuxterm-hq#6219).

The composer's Cloud start already passes the login (CloudStartChat+Login, #29771, #29962, #31183, #31264): DEV and dogfood builds only, on a machine the person owns, and recorded on the machine's harness_login row. start-session never took that step. It now runs the same step after the machine connects and before the session starts. passHarnessLogin now takes a harness name, so both entry points share one path.

CmuxNextApp line count is unchanged. The ratchet was paid by removing a redundant local and merging two declarations in CloudStartSession.run.

Changelog

Fixed: In DEV builds, cmux cloud start-session gives the Cloud machine your Claude login, the way a composer Cloud start does.

Test

cmux-ci run --class light --script scripts/ci/package-test-lane.sh --arg=suite --arg=Packages/macOS/CmuxNext --arg=CloudStartSessionTests ...

• Red at 7f96a7a0 (test only): fails on base, since CloudStartSession has no login step.
• Green at the head: results below once the fleet run ends.

Observed / Not run

• Observed: the pre-push gate (no new violations).
• Observed: the cloud-start-session capture at #31969's head 02834b16 failed, showing the credentials card (that run's screenshot).
• Not run yet: the capture rerun at this PR's head.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes cmux cloud start-session so the Cloud machine gets the person's Claude login before the session starts, matching a composer Cloud start. Previously a Claude session on a machine without the login answered every turn with the provider's credentials rejection.

• passHarnessLogin now takes a harness name, so CloudStartChat and CloudStartSession share one login path.
• The step runs after the machine connects, before the session starts, and only in DEV and dogfood builds. The run re-checks the asking account after it, since the login can wait on a confirm.