T3 Connect environment credential remains invalid after clean relink on 0.0.34 nightly

Summary

T3 Connect returns The environment credential is invalid when the client machine connects to the host machine, even after a complete unlink/relink with matching versions.

This appears to reproduce #5712 on a newer nightly.

Versions

• Client machine: 0.0.34-nightly.20260824.1176
• Host machine/CLI: 0.0.34-nightly.20260824.1176
• cloudflared: 2026.5.2
• Host OS: Windows

Steps to reproduce

1. Unlink the host machine with npx t3@nightly connect unlink.
2. The first relay-side DELETE returned HTTP 500.
3. Retry unlink successfully.
4. Verify status: desired:false, authenticated:true, linked:false.
5. Relink using npx t3@nightly connect link.
6. Start the matching server using npx t3@nightly serve.
7. Remove and rediscover the host environment on the client machine.
8. Attempt to connect.

Expected behavior

The client machine connects to the host machine through T3 Connect.

Actual behavior

The client reports: Connection failed. Reason: The environment credential is invalid.

Diagnostics

• Latest client trace ID: 2ba9e16a93017d38d20df8c62cb5a875
• Earlier client trace ID: 7fdf30773e43c0746a8c235da6c87dbe
• Environment ID is available privately to maintainers if needed.

The host reports T3 Connect desired link reconciled on startup, followed by four successful Cloudflare QUIC tunnel registrations. This indicates that the managed tunnel is healthy and the failure occurs during the credential/bootstrap exchange.

Start with the T3 Connect credential/bootstrap exchange on the client and compare it with the host's unlink/relink state and startup logs. Use trace IDs 2ba9e16a93017d38d20df8c62cb5a875 and 7fdf30773e43c0746a8c235da6c87dbe to follow the failure. Done means a clean relink with matching versions lets the client connect without the invalid-credential error.