#34427 Cloud start: a send waits for the Cloud pick's folder grant

Leo, on the "The app refused the agent connection." card under a failed "Set up a Cloud machine" step: "what happened here on this build?"

Fix-forward of the #34415 review follow-up. Picking Cloud granted the chip's folder fire-and-forget (void pickFolder), so a Return right after the pick could reach cloud.startChat before workspace.useFolder finished and still be refused as path_outside_roots.

Change

• App.tsx: cloudFolderGrant keeps the last Cloud pick's grant promise, from the composer's Cloud row and from the New Tab pick. The Cloud start's native call (oneCloudStart) waits for it first; a failed grant still lets the start go, and the host words its refusal (#34406).
• cloudRun.ts: newTabProjectPick takes an optional granted callback that receives the promise. Test in cloudRun.test.ts.

Risk: low. A Cloud start waits at most as long as the grant that is already in flight.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes a race where pressing Return right after picking Cloud could start before the folder grant completed, getting the Cloud machine refused as path_outside_roots.

The Cloud pick's folder grant (workspace.useFolder) now keeps its promise, and the Cloud start waits for it before sending. A failed grant still lets the start go, so the host's refusal wording is unchanged. Risk is low: the start waits at most as long as the grant already in flight.