Allow the restricted CI auth-agent to use a named TMB session instead of a native tng session.
- add
--tmb-instanceto auth-agent serving and LaunchAgent installation - load and validate the selected TMB device and account session at startup
- perform authenticated PDS requests through the TMB session agent
- report
authenticationSource, account identity, and session state in service status - preserve the existing native-session path when no TMB instance is selected
The resulting Unix socket remains compatible with the existing SPA/vsock bridge used by Spindle workers.