Web runs trust the project for Claude Code before the hand-off (fix #1493)

[suleimansh]

Plainly: starting a Claude web run on an untrusted project no longer needs the one-time "run claude there and accept the trust prompt" step. The framework writes the CLI's own trust record for the project root just before the --cloud hand-off, so the dialog never fires. Implements the plan merged in #1556; reverses the read-only-trust decision from #1318, per the maintainer stance in #1493 (UX > safety for now).

What changed

• src/claude-trust.ts — new writeClaudeTrust(root): read-modify-write of ~/.claude.json, setting projects[<root>].hasTrustDialogAccepted: true (the exact record the CLI writes when the user accepts). Preserves everything else in the file; creates a missing file; refuses (throws) to replace an existing file it cannot parse.
• src/driver/cloud.ts — CloudSession.prompt reads trust for trustRootOf(cwd) and writes it when absent, with a visible notice ("trusted for Claude Code on behalf of this run"). Best-effort: a failed write emits a notice and continues, and the existing dialog detection + manual advice stays as the safety net. New claudeConfig option so tests never touch the real ~/.claude.json (a gap in the plan — every existing driver test calls prompt()).
• Dashboard — the doomed-web-run warning (Web runs: ask for Claude Code folder trust in the dashboard instead of sending the user to the CLI #1318) and its onClaudeTrust RPC are removed end to end (form, rpc stub, impl, export): there is no doomed start left to warn about.
• Rationale recorded in the SPECs: starting a web agent on a project is itself the user's trust decision — the write automates consent already given, it does not invent it.

Verification

• Unit: 4 new claude-trust cases (preserve-siblings, create-missing, reshaped-projects, refuse-unparseable), 3 new cloud-driver cases (writes on the root before hand-off + notice, already-trusted stays silent, failed write says so and still hands off). 35/35 node tests, 13/13 StartAgentForm tests, both typechecks clean.
• Live (plan step 5, quota-free variant): in a fresh scratch repo the CLI (v2.1.235) shows the trust dialog under a pty; after writeClaudeTrust on that root it boots straight to the REPL, no dialog. The injected record is accepted as the CLI's own. Scratch entry removed afterwards.
• The full-suite daemon.test.js failures on this machine reproduce on untouched main (live daemon holds the port) — unrelated.

Closes the trust paper cut: web runs are click-and-it-works on a fresh project.