Fleet-spawned Muse requires interactive device authentication on an enrolled node

[kjgbot]

Problem

A fresh Muse worker spawned through an enrolled physical fleet node does not start its assigned task unattended. The Muse TUI opens a Meta OAuth device-login screen and waits for a human to approve a device code.

Reproduction

1. Run Agent Relay 12.4.0 on an enrolled node that advertises spawn:muse.
2. From another machine, run agent-relay fleet spawn muse --node dogpatch-mini --name --cwd --task .
3. The worker appears live in agent-relay fleet agent list.
4. Attach with agent-relay node agent attach --node dogpatch-mini --mode view.
5. Muse is waiting at a Meta device-authentication prompt and has not received or started the task.

This reproduced on dogpatch-mini even though other previously started Muse workers remained listed as live.

Expected

Fleet spawn should either reuse the node configured Muse subscription/authentication, inject a supported provider credential into the new worker, or fail before reporting the worker live with a precise provider-auth error and remediation.

Actual

The spawn command may return the older incomplete-receipt error while the worker is actually created. The new worker is then reported live but is blocked indefinitely on interactive device authentication.

Impact

Unattended orchestration silently stalls, capacity remains occupied, and the operator must attach manually before any repository work begins.

Acceptance criteria

• Fresh fleet-spawned Muse workers can start unattended when the node has valid Muse provider authentication.
• Missing or expired authentication fails closed with a specific status instead of reporting a task-ready worker.
• Readiness is not emitted until Muse has passed authentication and can accept the initial task.
• Regression coverage exercises the fleet spawn/readiness path and the missing-auth path.
• Existing authenticated Muse sessions continue to work.