[eas-cli] gate device-run-session serve-sim with the session token

[gwdp]

Why

serve-sim can now require a session token before it serves anything (assuming expo/serve-sim#49 merge). This turns that on for device run sessions.

How

Pass --require-token when we start serve-sim, then carry the token:

• Read it from serve-sim state file
• Send it to www as its own field, previewToken or webPreviewToken; Usage on expo/universe#30571
• Send it as a bearer header on the /metrics stream we collect, which is gated now

Needs a serve-sim release with the flag first. An older serve-sim rejects the unknown option and will not start, so this should land after that publishes.

Test Plan

• CI
• Local test with new serve-sim

[codecov]

Codecov Report

❌ Patch coverage is 91.66667% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.44%. Comparing base (9f5c20f) to head (774696e).

Files with missing lines	Patch %	Lines
...c/steps/functions/startAgentDeviceRemoteSession.ts	0.00%	1 Missing ⚠️
...ls/src/steps/functions/startAppiumRemoteSession.ts	0.00%	1 Missing ⚠️

Additional details and impacted files

@@                         Coverage Diff                          @@
##           gwdp/serve-sim-preview-token-cli    #4306      +/-   ##
====================================================================
- Coverage                             65.51%   65.44%   -0.07%     
====================================================================
  Files                                  1060     1058       -2     
  Lines                                 49307    49113     -194     
  Branches                              10438    10362      -76     
====================================================================
- Hits                                  32301    32137     -164     
+ Misses                                16890    16860      -30     
  Partials                                116      116              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[szdziedzic]

[P1] EAS CLI prints preview URLs without the token. The CLI query still requests only previewUrl/webPreviewUrl, then prints the bare URL. Gated serve-sim returns 401 for those links. Request previewToken/webPreviewToken in DeviceRunSessionQuery.ts, regenerate types, and append ?token= when formatting preview instructions. This affects every iOS session type; serve-sim-only sessions become unusable from the CLI.

[gwdp]

[P1] EAS CLI prints preview URLs without the token. The CLI query still requests only previewUrl/webPreviewUrl, then prints the bare URL. Gated serve-sim returns 401 for those links. Request previewToken/webPreviewToken in DeviceRunSessionQuery.ts, regenerate types, and append ?token= when formatting preview instructions. This affects every iOS session type; serve-sim-only sessions become unusable from the CLI.

Yep, I inverted order here; expo/universe#30570 was coming, but I missed that it needs to be before this.

Deploy order: #30628 → #30571 → serve-sim#49 publish → #4312 → #4306.

[linear-code]

ENG-22303

[github-actions]

✅ Thank you for adding the changelog entry!