[eas-cli] gate device-run-session serve-sim with the session token

[gwdp]

Why

serve-sim can now require a session token before it serves anything (assuming expo/serve-sim#49 merge). This turns that on for device run sessions.

How

Pass --require-token when we start serve-sim, then carry the token:

• Read it from serve-sim state file
• Send it to www as its own field, previewToken or webPreviewToken; Usage on expo/universe#30571
• Send it as a bearer header on the /metrics stream we collect, which is gated now

Needs a serve-sim release with the flag first. An older serve-sim rejects the unknown option and will not start, so this should land after that publishes.

Test Plan

• CI
• Local test with new serve-sim

[codecov]

Codecov Report

❌ Patch coverage is 81.81818% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 64.89%. Comparing base (3cb0291) to head (9a7dfce).

Files with missing lines	Patch %	Lines
...c/steps/functions/startAgentDeviceRemoteSession.ts	0.00%	1 Missing ⚠️
...ls/src/steps/functions/startAppiumRemoteSession.ts	0.00%	1 Missing ⚠️
...ls/src/steps/functions/startArgentRemoteSession.ts	50.00%	1 Missing ⚠️
.../src/steps/functions/startServeSimRemoteSession.ts	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4306      +/-   ##
==========================================
+ Coverage   64.82%   64.89%   +0.08%     
==========================================
  Files        1048     1048              
  Lines       48556    48571      +15     
  Branches    10240    10248       +8     
==========================================
+ Hits        31470    31516      +46     
+ Misses      16970    16939      -31     
  Partials      116      116              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

✅ Thank you for adding the changelog entry!