#35284 feat(next): select Cloud backend at runtime

Implements Leo's request that one NEXT build can work against each Cloud backend at runtime, following ARCHITECTURE-2026-11 T5/M5/M7.

• Rust owns the signed backend-origin allowlist, per-bundle selection, launch/env overrides, per-origin client-config cache, and temporary known-origin fallback.
• GET /v1/client-config supplies Stack/auth/service origins, image channel, and capabilities; malformed or untrusted configuration fails closed.
• Native code resolves through the bundled CLI, keeps Cloud unavailable without aborting the app when configuration cannot be loaded, and isolates credential storage per backend while preserving untouched historical defaults.
• Machine creates forward name, size, idle pause, bootstrap, and machine-config parameters. Rust performs capability preflight so unsupported options are refused before any create or approval is sent.
• Daemon backend replacement is authorized only by the one-shot app launcher marker; retained terminal processes cannot flip the shared owner.
• The Cloud proof workflow builds once and launches that same app against staging and production with separate agent credentials.

Verification: fleet Rust tests passed for cmux-cloud-environment (16 tests, 0.01s test runtime; run 41817516522, source f114f0ea3e9506e387a1472974c4ec6240e96583). Static prepush checks passed. The platform strict-create seam is tracked separately in manaflow-ai/cmux-platform PR #801.

agent-identity footer --repo manaflow-ai/cmux

🤖 Generated with Codex

Agent session: agent session

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

A single NEXT app build now selects its Cloud backend at runtime, so the same bundle can sign in and run against staging or production without rebuilding.

• Rust owns the signed backend-origin allowlist, fetches GET /v1/client-config, and caches configuration per backend; malformed or untrusted configuration and unsupported machine-create options fail closed. The fetched config routes all cloud, relay, VM, and platform services.
• Select a backend at launch with --cloud-backend or CMUX_NEXT_CLOUD_BACKEND, or switch in DEV and nightly builds with cmux cloud env set; Release and RC default to production and accept allowlisted launch backends.
• Switching restarts the daemon while PTY hosts keep running, isolates credentials, device-hub, and install storage per backend, and is authorized only by the one-shot app launcher marker; terminals cannot flip the shared owner.
• Agent, CLI, and script machine creates now require native confirmation regardless of settings.
• The Cloud proof workflow builds once and runs the same app against staging and production with separate agent credentials; cleanup confirms the target before killing, fails closed when the target is unknown, and keeps failure evidence bounded to the proof log start marker.