The closed API now membership-gates /parties/sync-room/* per request via
the session cookie and no longer puts a bearer token in sync-stack layer
descriptors. Pass a credentials:include fetch into SyncStack so live-layer
HTTP ops (manifest/bodies/put) carry the cookie; the realtime WebSocket
already gets it automatically (same-site handshake).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014dasZuqo6FStgT3rkC85im
8e99f5c5ac