Groundwork for a hybrid sign-in with an injected organization token

What

These changes prepare for a sign-in where the program hosting Claude Code hands it a token for an organization:

• Remote managed settings, which an organization pushes to Claude Code, can now be fetched with an injected token. It is tried after an API key and before your profile credential, sent as a Bearer header, and also used to tell cached settings apart. It is used only when the host passes --host-auth-is-org-sign-in.
• The settings fetch takes a hybridOrganizationUuid, and background checks set refreshesHybridToken, which is true by default.
• Sign-in state gains hybridTokenRenewalDue, hybridOrganizationUuid and hybridSignInEnded, and another request builder also receives hybridOrganizationUuid.
• The session tunnel now reads an env list from what it is sent, applies its text values as environment variables, and logs how many it applied.

Why

This mostly concerns programs that embed Claude Code. It means a hosted session can supply a token and environment variables to Claude Code and have it fetch managed settings with that token.