Cloud sessions get their own sign-in, so Console accounts can use them

What

Cloud sessions (Claude Code sessions that run on another machine) used to need a claude.ai sign-in. Claude Code now keeps a separate credential for them, cloudSessionsOauth:

• Sign-in: a browser sign-in flow for cloud sessions checks that the organization and account match, and times out after 5 minutes ('The browser sign-in for cloud sessions timed out after 5 minutes. Try again.'). The credential is stored and refreshed under a lock.
• Session calls: requests for cloud-session events, titles, archiving and polling now use a token from your profile and skip the trusted-device header when a profile is in use.
• Logout: logging out now revokes and removes the cloudSessionsOauth refresh token as well. Before, only the design sign-in token was revoked.
• Cloud mode: when running as a cloud (cowork) session, remote settings are passed through a transform, no signature is kept, the signed-cache check is skipped and clearing the cache does nothing. The secure-storage write lock is bypassed in some cases and no local storage folder is used.
• Smaller changes: the skills sync request passes along an earlyAnswer value, and settings error objects carry a new loadedWithoutGuardHook field.

Why

People who sign in through the Console, not claude.ai, can now reach cloud sessions. Logging out now also ends that cloud-session access.