fix: close the three remaining gaps, and repair a test I silently disabled

FIRST, the self-inflicted one. My edit in a20702d inserted a test between an
existing `#[test]` and the function it belonged to. The result compiled and
looked fine: `every_anthropic_spelling_is_one_family` lost its attribute and
STOPPED BEING A TEST, its doc comment ended up describing my test instead, and
my test carried two `#[test]`s. It has not run since — in already-deployed code.
Nothing failed, which is the point: a test that does not run is indistinguishable
from one that passes. Found via a compiler warning I had not read.

The commit message on a20702d said "241 lib tests pass". 240 ran.

Then the three gaps.

1. A security scan could not read history. `ensure_checkout` clones with
   `--filter=blob:none` — full commits, blobs on demand — and the agent
   environment has NO network route to the forge. Measured: gitleaks on a
   4-commit repo reported "1 commits scanned" and "could not fetch <sha> from
   promisor remote". A credential committed and later deleted is exactly what a
   scanner looks for and exactly what a lazy blob withholds. Missions with a
   `security_scan` phase now clone fully; everything else keeps the cheap path.

   (I first blamed `--depth 1`, from a stale module doc comment. The code has
   said `--filter=blob:none` since it was written, and the comment at `clone`
   explains why NOT shallow — a shallow clone cannot push a branch back. Both
   the comment and my claim are fixed.)

2. `benchmark_runner` never ran as part of a benchmark phase. It was reachable
   only from an operator button, so the `author_and_baseline` recipe authored
   benchmarks and measured nothing — `benchmark_snapshots` stayed empty. Now
   baselined from the sweep, SPAWNED not awaited: BENCH_TIMEOUT is 30 minutes
   and that loop also starts, closes, evaluates and captures every phase on the
   platform. A `NOT EXISTS` guard on iteration 0 makes per-tick firing safe. A
   repo with no bench harness logs and does NOT fail the phase — but it logs,
   because "no baseline" must not read like "not attempted".

3. The World's rich layer was empty for every mission. `run_events::append` is
   called only from the a2a path, and `world.rs` tailed only that table —
   while mission per-step detail has always lived in
   `topology_runs.checkpoint.records`, which `topology::run_events_sse` streams.
   The data was never missing; the viz read the one source missions never write.
   Now both are tailed, mapped through the existing `step_started` vocabulary so
   no new event types are needed.

242 lib tests, 20 test binaries, zero warnings.

crates/cm-api/src/routes/world.rs

@@ -341,6 +341,11 @@ pub async fn world_live(State(state): State<AppState>, Authed(user): Authed) ->
         let mut last: std::collections::HashMap<String, String> = std::collections::HashMap::new();
         // Per-run journal cursor so we stream only NEW run_events each poll.
         let mut cursors: std::collections::HashMap<String, i64> = std::collections::HashMap::new();
+        // How many checkpoint step-records of each run have already been sent.
+        // Separate from `cursors`: that tracks `run_events.seq`, and the two
+        // sources are populated by different paths — see the loop below.
+        let mut step_cursors: std::collections::HashMap<String, usize> =
+            std::collections::HashMap::new();
         // Audit-log cursor for edge-initiated inter-agent events (delegation,
         // A2A) that bypass the run loop. -1 until seeded on the first pass.
         let mut audit_cursor: i64 = -1;
@@ -426,6 +431,54 @@ pub async fn world_live(State(state): State<AppState>, Authed(user): Authed) ->
                 // Tail the run's journal for richer real events (reasoning, tool
                 // convergence, doors). On first sight, jump the cursor to the
                 // current max so we stream forward without replaying the backlog.
+                // Mission runs write NO `run_events`: `run_events::append` is called
+                // only from the a2a path. Their per-step detail lives in
+                // `topology_runs.checkpoint.records`, which is what
+                // `topology::run_events_sse` has always streamed. So the World's
+                // rich layer was empty for every mission on the platform — not
+                // because the data was missing, but because this read the one
+                // source missions never write.
+                //
+                // Both sources are tailed, because both are real: a2a runs
+                // populate the table, topology runs populate the checkpoint.
+                let steps: Vec<Value> = sqlx::query_scalar::<_, Option<Value>>(
+                    "SELECT checkpoint FROM topology_runs WHERE id = $1::uuid",
+                )
+                .bind(run_id)
+                .fetch_optional(&pool)
+                .await
+                .ok()
+                .flatten()
+                .flatten()
+                .and_then(|c| c.get("records").cloned())
+                .and_then(|r| r.as_array().cloned())
+                .unwrap_or_default();
+                let already = *step_cursors.get(run_id).unwrap_or(&0);
+                if already < steps.len() {
+                    for rec in &steps[already..] {
+                        // A node turn IS a step. `step_started` is what
+                        // `normalize_run_event` already maps to a tool call, so
+                        // the viz needs no new event vocabulary.
+                        let role = rec
+                            .get("role")
+                            .or_else(|| rec.get("node_id"))
+                            .and_then(|v| v.as_str())
+                            .unwrap_or("turn");
+                        for (t, d) in normalize_run_event(
+                            agent_id,
+                            "step_started",
+                            &json!({ "tool": role, "input": rec.get("output").cloned().unwrap_or(Value::Null) }),
+                        ) {
+                            yield sse(t, d);
+                        }
+                    }
+                    step_cursors.insert(run_id.clone(), steps.len());
+                } else if !step_cursors.contains_key(run_id) {
+                    // First sight: jump to the end rather than replaying the
+                    // backlog, matching how the run_events cursor below behaves.
+                    step_cursors.insert(run_id.clone(), steps.len());
+                }
+
                 if let Some(&after) = cursors.get(run_id) {
                     let rows = sqlx::query(
                         "SELECT seq, event_type, payload FROM run_events