A claimed PC forgets the old login and the old cameras

Seen on the first claimed demo install: 'session expired' on every
screen, signed in as a user from the previous demo's head office, and
'Watching 3 cameras' for a shop with one - the PC had offered its two
leftover cameras up to head office, without their passwords, so the
same lens was listed twice and one copy could never be pushed anywhere.

Claiming now clears any stored session (a new head office is a new
world), a session whose refresh fails is forgotten on disk as well as
in memory so the app returns to Login by itself, and the demo setup
removes cameras left from an earlier install before it joins the shop,
because head office is the source of truth from then on.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KGcjxF1cNLcuwc3DAPcnfj

agent/cmd/behavision-setup/main.go

@@ -136,6 +136,16 @@ func run() error {
 	// Proving it starts is the point. An installer that reports success and
 	// leaves a shop with an engine that will not run has done worse than
 	// failing: the failure surfaces later, to someone who did not install it.
+	// Joining a shop: head office supplies the cameras, so any left on this PC
+	// from an earlier install go first. Otherwise the reconciler offers them UP
+	// to head office - without their passwords, which the engine never returns
+	// - and the shop ends up with the same lens listed twice, one copy of which
+	// can never be pushed to another PC. Measured on the first claimed demo.
+	if bundle != nil && bundle.EnrolCode != "" {
+		if err := os.Remove(paths.CamerasFile()); err == nil {
+			step("Earlier cameras", "removed - head office supplies them now")
+		}
+	}
 	if err := smokeTest(vpy, demoCams); err != nil {
 		return fmt.Errorf("the engine installed but would not start: %w", err)
 	}
@@ -523,6 +533,7 @@ func claimShop(code, base string) (string, error) {
 	cfg.AgentToken = b.AgentToken
 	cfg.CloudBase = base
 	cfg.Standalone = false
+	cfg.SessionToken, cfg.SessionRefresh, cfg.SessionEmail = "", "", ""
 	caPath, err := enrol.SaveCA(b.CACert, paths.BrokerCA())
 	if err != nil {
 		return "", err