Remote/cloud session denials from org policy now get logged consistently

What

• When the allow_remote_sessions org policy blocks a cloud/remote-session action - in the /ultrareview command and in --print --teleport resume - Claude Code now fires a tengu_org_policy_denied telemetry event carrying the policy key, the kind of denial, and a surface tag (slash_command for ultrareview, cloud_session for teleport).
• The remote-control bridge's disabled-reason check (renamed from getBridgeDisabledReason to getBridgeDisabledDiagnosis) now returns a structured result with an orgPolicyDenied flag; when set, the CLI logs the denial and flushes analytics before exiting with the error.
• A non-interactive/stream 'ready' check that refuses because the feature is unavailable now also logs this same org-policy denial before returning the refusal.

Why

This gives Claude Code (and its admins) visibility into how often and where organization policy is blocking remote or cloud session features, rather than the refusal happening silently.