Claim a handoff token and return the session identity + tail.

Args: token: Opaque urlsafe token presented by the dashboard. request: FastAPI request (used to resolve the workdir).

Returns: JSON envelope with session_id, task_id, source_surface, claimed_at, note and tail (a list of recent stream entries).

Raises: HTTPException: 404 for unknown tokens, 410 for expired or already-claimed tokens.