Managed-settings token checks gain unanchoredClaims, with more restricted-mode changes

What

Managed settings are settings an organization deploys to control Claude Code. They can arrive as a signed token, a piece of data whose signature proves where it came from. How that token is checked, and some related handling, has changed:

• The check now takes an unanchoredClaims option. Its "claims" are statements inside the token, such as who it is meant for (aud) and who it is about (sub). These two are now compared only when expected values are supplied, or when unanchoredClaims is set to "refuse". Before, they were always compared.
• One check that runs while managed settings are being handled now passes unanchoredClaims: "refuse".
• The check now also returns the token's organizationUuid and accountUuid.
• In a particular restricted mode, managed-settings handling now keeps claudeMd from the verified settings. claudeMd is the setting that adds organization-wide CLAUDE.md instructions.
• In the same mode, the decision log for auto mode now stops early, before it checks AUTOMODE_DECISION_LOG.

Why

This changes how strictly the signed managed-settings token is checked. When "refuse" is used, a token that does not name the expected audience and subject is no longer accepted without question. Organizations deploying managed settings, including organization-wide CLAUDE.md instructions, may see different behaviour in the restricted mode.