Per-project host selection (Local Docker or AWS), AWS-CLI-style login,
tiered permission check, detect-then-join-or-deploy environments,
strict per-user tenancy by default, Secrets Manager delivery, Hybrid
EFS/ephemeral storage, in-container agent over SSM port forwarding,
and a phased plan starting with a ProjectHost abstraction refactor.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>