fix(ssh): turn a host's orca CLI control on by default and stop resetting saved choices (#29856)

* fix(ssh): allow a host's orca CLI to control Orca by default, and stop resetting saved choices

An absent allowRemoteCliControl now means on; only an explicit false turns the
desktop browser bridge and relay-era orchestration commands off. Removes the
one-time reset of saved true values, the consent stamp writes and the reset
notice, which would have silently turned off hosts upgraded from stable.

* fix(ssh): keep the CLI control choice when adding a host from the sidebar

* fix(ssh): read an older client's omitted CLI control switch as off over RPC

* fix(ssh): check the managed fence before routing settings in browser bridge candidates

src/shared/ssh-remote-cli-control.ts

@@ -0,0 +1,8 @@
+import type { SshTarget } from './ssh-types'
+
+/** On unless the user turned it off; a missing target (removed host) is never allowed. */
+export function isRemoteCliControlAllowed(
+  target: Pick<SshTarget, 'allowRemoteCliControl'> | null | undefined
+): boolean {
+  return target != null && target.allowRemoteCliControl !== false
+}

src/shared/ssh-types.ts

@@ -71,13 +71,10 @@ export type SshTarget = {
   relayGracePeriodSeconds?: number
   /** Lets this host's `orca` CLI drive this desktop's Orca browser tabs in the host's own
    *  workspaces (desktop browser bridge) and its relay-era terminals' orchestration commands.
-   *  Off by default: the host is a guest, not an owner. */
+   *  On unless explicitly `false`; read it through `isRemoteCliControlAllowed`. */
   allowRemoteCliControl?: boolean
-  /** Stamped when the switch is turned on with that meaning. A `true` without it was set while the
-   *  switch did nothing (1.4.225 onward), so load turns it off and asks for a fresh opt-in. */
+  /** Retired: written by earlier builds and ignored now. Kept so a downgrade still finds its stamp. */
   allowRemoteCliControlConsent?: 'desktop-browser-bridge'
-  /** Orca turned the switch off for that reason; settings say why until the switch is saved again. */
-  allowRemoteCliControlReset?: boolean
   /** Set to true after a successful connection that triggered a credential
    *  prompt (passphrase or password). Persisted so startup reconnect can
    *  partition targets into eager (no passphrase) vs deferred (passphrase)