design(remote): launch a session on a host, and enrol the host

[devsuitup]

Two related gaps.

Launch. Starting a new Claude session on a declared host, with a locally
generated session id so Switchboard can find it again, inside whatever
multiplexer the host offers — or headless where it offers none.

Enrolment. The first connection to a host, today entirely manual: ssh
reachability, the CLI present and its version, a multiplexer or none,
~/.claude present, and the account logged in.

The hard part is authentication on a machine with no browser. It must happen
on the host, performed by the person, once. Copying credentials from the
workstation is out of the question — the sensitive-path denylist refuses
.claude/.credentials.json deliberately (#208), and a design that fights that
rule is the wrong design.

Scope: a guided enrolment that reports what it found, states what is missing,
and hands the person the exact command to run where it must be run. It reports
state; it does not acquire credentials.

Unverified: what the CLI supports for a browserless login today, and whether a
token-based path conflicts with the flags a host may already use.