multi-account selection: --account-name hint, exit 3 NEEDS_HUMAN

onboard-driver.py accepts --account-name and forwards to muse-signin.py.
muse-signin.py detects Meta multi-account selection after OTP submit:
with a hint it clicks the matching display-name button (never the +1
collapsed entry); without a hint (or no match) it exits 3 so the queue
marks the job needs_human instead of stalling.

bin/onboard-driver.py

@@ -8,7 +8,8 @@ Runs INSIDE the node's netns (via netvm-exec.sh). Reads the identifier
   onboard-driver.py --node muse --service muse --id-type email --step submit
 
 Exit codes: 0 = step done, 2 = APPROVAL_NEEDED (code sent, awaiting OTP),
-1 = failed. The identifier/code are passed to the local signin script as
+3 = NEEDS_HUMAN (multi-account selection needs a person), 1 = failed.
+The identifier/code are passed to the local signin script as
 argv (transient, same trust domain — bl is operator infrastructure);
 they never cross a network boundary except inside the already-encrypted
 VM->bl SSH stdin pipe.
@@ -49,6 +50,8 @@ def main():
     p.add_argument("--id-type", required=True)
     p.add_argument("--step", required=True, choices=["initiate", "submit"])
     p.add_argument("--dry-run", action="store_true")
+    p.add_argument("--account-name", default=None,
+                   help="display-name hint for multi-account selection")
     args = p.parse_args()
 
     lines = sys.stdin.read().splitlines()
@@ -79,6 +82,8 @@ def main():
         return 1
 
     cmd = [sys.executable, SIGNIN, "--node", args.node, "--email", identifier]
+    if args.account_name:
+        cmd += ["--account-name", args.account_name]
     if args.step == "submit":
         if not code:
             print("ERROR: no code on stdin", file=sys.stderr)