#32525 Cloud Native: name the step a refused Native call came from

Why. A capture's cloud.machines reply showed link_route: "link (native failed: refused(400))". NativeDeviceEnrollmentError.refused is thrown from four places (device revoke, owner ops such as host.enroll/host.network.bind, the signed Native reads, and the host.network.target read), so the reason didn't say which call got the 400.

What.

• refused(Int) becomes refused(Int, step: String). The step is the owner op name, or METHOD /path with device and mesh ids swapped for {device}/{mesh} (via NativeDeviceScope.step). It never holds an id or a token.
• NativeDeviceEnrollmentError now conforms to CustomStringConvertible. Every other case prints exactly what it printed before, and refused prints refused(400) at POST /v1/devices/{device}/signed/tunnel (or ... at host.network.target).
• The two tests that build refused are updated. CloudNativeFirstLauncherTests now checks the literal route string link (native failed: refused(400) at host.network.target).

Risk. None. Only the error's detail changes; nothing branches on the status or the step.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Makes NativeDeviceEnrollmentError.refused carry the step that got the status, so the cloud.machines link route says which call was refused instead of just refused(400).

• refused(Int) becomes refused(Int, step: String); the step is an owner op name or a METHOD /path template with device and mesh ids replaced by {device}/{mesh}.
• NativeDeviceEnrollmentError now conforms to CustomStringConvertible, printing every case exactly as before except refused, which prints e.g. refused(400) at POST /v1/devices/{device}/signed/tunnel or refused(400) at host.network.target.
• Only error detail changes; nothing branches on the status or the step.