feat(podcast): render finished missions into episodes, and serve them as a feed

The renderer existed but nothing called it. This wires it to the missions and
puts the result somewhere a phone can reach.

**A sweep, not a phase step.** Rendering is not the agents' work and must not be
able to fail a phase that succeeded; a transient API error simply retries next
tick, and a mission already rendered is skipped because its episode row exists.
`podcast_episodes` is that record — without it the sweep would re-render on
every pass and re-bill for it, the same lesson `corpus_items` taught for papers.

**It is racing a reaper.** script.md lives in the mission checkout, and
`mission_runtime`'s sweeper deletes that tree 30 minutes after the mission
reaches a terminal state. So the sweep runs every 2 minutes, leaving ~15
attempts inside the window. When it does lose — as it did for three missions
that had completed hours before this shipped — it now SAYS so and records a
marker rather than skipping in silence, which is how a feed ends up quietly
missing a day. The feed filters those markers out: a zero-byte enclosure shows
a broken episode in a podcast app, where showing nothing is honest.

**Duration is read from the audio, not estimated from the script.** The feed
advertises a length and that length should be the real one — and it is the check
that catches a 6 MB file playing for six seconds.

**The feed authenticates by query-string token**, because no podcast app can set
headers. That is a real trade: the token lands in the app's database and any
proxy log. It reuses `AuthService::authenticate`, so revoking the session
revokes the feed with it rather than creating a second secret to forget to
rotate. Titles are XML-escaped — one raw ampersand makes a client reject the
WHOLE feed, not one episode.

363 tests pass.

Co-Authored-By: Claude Opus 5 <[email protected]>

crates/cm-api/src/lib.rs

@@ -500,6 +500,13 @@ pub fn router(state: AppState) -> Router {
         // The workflow recipe catalog (templates/workflows/*.toml). Serving it
         // lets the client stop mirroring the phase composition table inline.
         .route("/api/workflows", get(routes::missions::list_workflows))
+        // The private podcast feed. Token in the query string, not a header:
+        // no podcast app can set headers. See `routes::podcast`.
+        .route("/api/podcast/feed.xml", get(routes::podcast::feed))
+        .route(
+            "/api/podcast/episodes/{file}",
+            get(routes::podcast::episode_audio),
+        )
         .route(
             "/api/missions/{id}",
             get(routes::missions::get)