#35858 Enable headless Cloud link credentials

Problem

Headless Cloud link operations need a direct API credential source on Linux when no Mac relay or inherited broker is available.

Change

• Add explicit CMUX_CLOUD_API_URL plus install-token / 0600 token-file credentials for link serve and ensure.
• Read token files per request so rotation works, trimming newline-terminated tokens.
• Decode Cloud connect-info and link-token response envelopes and keep credentials out of errors.
• Preserve relay and broker precedence and fail closed when no source is configured.

Validation

• Focused direct-source tests cover token-file rotation and trimmed newline tokens.
• Fleet Rust test: cmux-ci test -- cargo test -p cmux-tui link::cloud::direct_tests

Risk

Low. The direct source is opt-in and only selected when explicitly configured; relay and broker paths remain unchanged.

agent-identity footer --repo manaflow-ai/cmux
🤖 Generated with Codex

Agent session: agent session

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds a direct Cloud API credential source for headless Linux links so cmux link serve and ensure can reach the Cloud when no Mac relay or inherited broker is available.

• New DirectSource uses CMUX_CLOUD_API_URL plus either CMUX_CLOUD_INSTALL_TOKEN or a new --cloud-token-file flag (files must be mode 0600 and their contents are trimmed).
• Token files are re-read on every request so rotation takes effect without restart.
• Decodes Cloud connect_info and link_token response envelopes and keeps install tokens out of debug output and errors.
• Source precedence stays relay, then direct, then fail closed as unavailable; broker paths are unchanged.
• API origins must be HTTPS (HTTP allowed only for localhost) with no path, query, userinfo, or fragment.