CCR auth-token refresh now also accepts a non-JWT 'gateway placeholder' session token
When Claude Code Remote refreshes its authentication token, the session token it receives can now be one of three things: a decodable JWT (checked as before for expiry and staleness), a non-JWT "gateway placeholder" token that must match either the token currently held in the process or a previously verified JWT, or a token that gets rejected outright. When a placeholder token is adopted, it's logged in the cli_worker_auth_refresh_adopted event with a new session_token field describing which of these cases matched.
This lets remote authentication refresh handle a wider range of valid session token formats without weakening the checks that reject tokens that don't match anything trusted.