Console-profile sign-ins get their own handling for cloud-session requests

What

Claude Code can be signed in through claude.ai or through a Console profile. Requests to cloud sessions (Claude Code running on a remote machine) now treat Console-profile sign-ins differently:

• When the sign-in is a Console-profile one (isConsoleProfileSessionsCredential), the token for cloud sessions comes from sessionsApiAccessToken, with cloudSessionsSignInRefusal for refusals, instead of the usual sign-in token stored in the system keychain.
• The request path used for teleport has a new branch. If no claude.ai sign-in is present, it returns no credentials with the message "A Console-profile sign-in is in use; this needs a claude.ai sign-in".
• That branch removes x-trusted-device-token headers and adds an early-answer step for GET requests.
• In another request builder, X-Trusted-Device-Token is now sent only when the sign-in has no profile, and x-organization-uuid is taken from the sign-in's orgUUID. Before, the trusted-device header was always sent.

Why

If you sign in with a Console profile rather than claude.ai, cloud-session features may now behave differently, and some will tell you they need a claude.ai sign-in.