[BUG] Routine-fired runs that create a fresh cloud session crash at Claude Code startup (turns=0); interactive sessions and into-existing-session deliveries work

In claude.ai/code, every **routine-fired run that must create a fresh cloud session** crashes at Claude Code startup with `error_during_execution, turns=0` — while interactive sessions and scheduled deliveries into an *existing* session work fine on the same account, same repos, same hour.

**Crash signature (identical in all four runs, from `GET /v1/code/sessions/{id}/events`):** provisioning is fully green (`Allocating sandbox` → `Cloning repository` → `Finished processing sources` → `Claude Code executor created` → `Claude Code process started`), then 3–6 seconds later:

```
assistant: An error occurred while executing Claude Code. You can try again by sending a new message or starting a new session.
result: error_during_execution is_error=true turns=0 duration=0s
env[error]: Claude Code execution failed
```

**Reproduction:** create any `run_once_at` routine via `POST /v1/code/triggers` with a trivial prompt; let it fire (or fire it via `/run`). 4/4 crashes on this account, 2026-08-17 22:46–23:27 UTC:

| Session | Fired | Repo | Variation |
|---|---|---|---|
| `cse_011CQM1p2vzoRfosQvZSE5Ri` | 22:46:00Z | private repo A | minimal `allowed_tools` (Bash/Read/Glob/Grep) |
| `cse_01Gykfbz65kFT6FWfWxFGXHY` | 22:49:30Z | private repo A | same config, manual `/run` retry |
| `cse_018Byi54XRuZebVG3XfUkL1o` | 22:52:41Z | private repo A | `preset:default` + full tools list |
| `cse_01NNo33JqcRoAsHNJk5QG7Sh` | 23:27:22Z | private repo A | after interactive success (below) |

Plus one on a different, public repo (`cse_01A6acJgXFdcKaYoDrbX5tVR`, 22:59:35Z) — same crash. Ruled out: repo choice, presence/absence of a committed `.claude/settings.json` (public repo has none), tools-list shape, scheduled-fire vs. manual run.

**What works on the same account in the same hour (~23:10–23:35 UTC):**
- A user-initiated interactive claude.ai/code session on repo A: started normally, ran Bash, and called the auto-attached Claude Code Remote MCP tools successfully (`list_triggers` and `send_later` — notably with none of the `-32003 "MCP tool call requires approval"` errors from #61044, which we'd reported on that issue earlier).
- That session's `send_later` trigger fired at 23:31:00Z and **delivered into the existing session on time** — so the scheduler and the deliver-into-existing-session path are healthy. Only the create-a-fresh-session path dies.

**Possibly relevant observations:**
- Every crashed run's event log contains one pre-crash `system/hook_started` event (no hooks configured in either repo or the environment; no setup script).
- Routines auto-attach the `Claude_Code_Remote` connector (`connector_uuid bf7c680d-5fdc-5ef4-b4a0-abadb619bf0a`, `https://api.anthropic.com/v1/code/mcp/meta`) with `permitted_tools: []`.

Possibly related to the #61044 / #61015 routine-degradation cluster (same surface, different symptom — that one is mid-session tool denial, this is startup death). Happy to provide more event logs or run further controlled probes on request.

Reproduce with POST /v1/code/triggers and inspect GET /v1/code/sessions/{id}/events, comparing a fresh-session routine run with delivery into an existing session. Start with the provisioning and startup event sequence, especially the pre-crash system/hook_started event and the auto-attached Claude_Code_Remote connector. Done means routine-fired fresh sessions start successfully without error_during_execution at turns=0.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.