#35642 cloud journey: fall back for VM API exec

The staging Cloud journey reaches the real VM, but --cmux stops at cmux machine access exec when the VM API provider returns its documented 501 cloud.provider.unsupported response for client sessions. This keeps the real CLI path for supported providers and falls back to the journey's existing direct machine exec route for that specific response, allowing the journey to continue to link, sync, and handoff checks.

Adds focused unit coverage for the fallback detector. Fleet validation: cmux-ci test -- bun test scripts/cmux-next/cloud-journey.test.ts.

Leo asked: “let's also get our iteration loop good for the whole "working on cloud" type thing”.

🤖 Generated with Codex

Agent session: agent session

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Falls back to the journey's direct machine exec route when cmux machine access exec reports the documented 501 cloud.provider.unsupported client-session refusal, keeping the real CLI path for supported providers.

• The CLI now runs with --json; successful execs read the structured result, and the fallback detector matches the refusal only as the cloud_client_session.failed stderr object on a non-zero exit, so a guest command can't forge it through stdout. Adds unit coverage for the detector.
• The fallback latches after the first refusal; later execs skip the real CLI and route directly.
• CI: the headless journey build honors a configured cmux-tui target directory and passes that binary path to the job.