Under the hood
Hosts can now force gateway auth and routing through a policy check, independent of your env vars.
Provider detection now also treats the session as a Cloud gateway provider when a new host policy reader, gatewayRequiredByHostPolicy, returns true, in addition to the existing gateway-server-process checks. This gives hosts a way to force gateway auth and provider routing independent of the CLAUDE_CODE_USE_* environment variables.