Locally managed login pins now take precedence over server-managed settings

What

Managed settings are settings an administrator controls for you. They can come from local device-management tools (MDM), from a managed settings file on the machine, or from Anthropic's servers. forceLoginOrgUUID pins claude.ai logins to one organization, and forceLoginMethod restricts which login method you can use.

• The settings description now says forceLoginOrgUUID and forceLoginMethod (claudeai or console), when set by local MDM or a managed file, apply ahead of server-managed settings in both merge modes.
• Two new helpers read the machine policy. One reports whether the machine administrator may pin the sign-in organization, and assumes yes if the policy cannot be read. The other reports whether the policy sets forceLoginOrgUUID. Read failures are logged as machineAdminMayPinSignInOrg: the machine policy read threw: and machineAdminPinsSignInOrg: the machine policy read threw:.
• The saved copy of remote managed settings on disk is now checked against the account and organization pins. If it is not trusted, Claude Code treats it as missing.
• A .synced-at stamp file records when settings were last synced.
• Managed settings files gain file-protection tracking, and the login pins are carried across the different settings sources.

Why

An administrator's local login pins can no longer be overridden by settings from the server. A saved copy of remote settings that does not match those pins is ignored rather than applied.