Pass saved machine variables to repository setup

[ymichael]

Human comments

What was wrong

Variables saved in Machine environment were omitted from ordinary repository setup. A script needing a configured token could fail even though BB had saved the value correctly. The machine-environment support in PR #3274 supplied explicit hooks, but normal setup ran through environment.attach without those values.

What changed

Resolve fresh machine variables on the server when dispatching setup, then pass them transiently through environment.attach into the existing setup runner. The retained provisioning request stays free of plaintext values. Existing encryption, precedence, cancellation and recovery behavior remain; unmanaged attached paths still skip setup.

Adds the validated attach contribution field and bumps host-daemon protocol 204 → 205, requiring older daemons to update. Updates the configuration documentation, machine CLI guide and bb-cli reference. No new user-facing setting or CLI command.

How you verified

• Server-delivery and setup-shell regressions failed before the fix and pass afterward.
• 146 tests pass: 57 server, 30 daemon, 56 contract and 3 integration tests. Coverage includes fresh values on repeated dispatch, local-host exclusion, encrypted storage, retained request/state privacy, missing-key failure, cancellation with duplicate attaches, explicit hooks, cloning and old-protocol rejection.
• Turbo builds and typechecks passed for @bb/server, @bb/host-daemon and @bb/host-daemon-contract; formatting and diff checks passed.
• Started pnpm start:worktree, configured Modal, and created a test thread through the BB CLI. A real Modal sandbox installed this server’s daemon, cloned a disposable repository, and ran ordinary setup. Setup required a configured test variable and wrote a receipt; the live Codex thread read the receipt and returned PASS. The initial byte comparison omitted the receipt’s trailing newline; the corrected check passed without changing the file.

Focused commands:

pnpm exec turbo run test --filter=@bb/server -- test/hosts/live-command.test.ts test/internal/internal-session-protocol-version.test.ts test/services/environments/provider-orchestration.test.ts src/services/hosts/host-environment.test.ts
pnpm exec turbo run test --filter=@bb/host-daemon -- test/command/environment-dispatch.test.ts test/command/environment-hook.test.ts test/command/command-router.test.ts test/command/project-clone-private-env.test.ts src/operation-environment.test.ts
pnpm exec turbo run test --filter=@bb/host-daemon-contract
pnpm exec turbo run test --filter=@bb/integration-tests -- fake/environments/environment-attach-recovery.test.ts
pnpm exec turbo run build typecheck --filter=@bb/server --filter=@bb/host-daemon --filter=@bb/host-daemon-contract
pnpm exec turbo run build typecheck lint --cache-dir=.turbo/cache --output-logs=new-only --concurrency=4

AGENT GENERATED