fix(missions): grant coding tools + pin claw workspace to /mission/repo

Mission agents were burning ~275K tokens producing nothing: the coder had
only file_read and its workspace was the empty ephemeral sandbox, so it
dumped a full spec inline instead of writing files. Two root causes:

1. Risk-profile allowlists used pre-0.8 tool names. `coding_readwrite`
   allow-listed `file_write` (renamed to `file_edit` in ZeroClaw 0.8, and
   `file_write` now refuses on ephemeral workspaces) and omitted file_edit
   / content_search / glob_search / git_operations — the exact tools the
   phase prompt tells agents to use. Since allowed_tools is a strict
   allowlist, agents were effectively read-only. Documents the correct
   profiles in agent.config.example.toml (they only lived in host config;
   the live runtime profiles were corrected via its config API).

2. workspace.path never got set. `agents.<alias>.workspace.path` is an
   Option<PathBuf> the ZeroClaw Configurable macro skips from prop
   enumeration, so provision_claw's set_prop always 404'd and the whole
   call errored into a swallowed eprintln. Removes the dead set_prop and
   pins the workspace out-of-band: MissionRuntimeProvisioner::
   pin_agent_workspaces patches the shared config file on the per-mission
   container (format-preserving via toml_edit, atomic temp+mv); the daemon
   applies it on the same reload that surfaces the freshly-provisioned
   claws. Covered by unit tests for the TOML stamp.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

crates/cm-api/src/routes/teams.rs

@@ -130,11 +130,10 @@ pub(crate) async fn build_team_with_lifecycle(
         .await?;
         let claw_id = agent.id.as_uuid();
         let risk = RuntimeProvisioner::default_risk_profile_for_role(&m.role);
-        // No workspace override on the ad-hoc team-wizard path — those
-        // teams aren't mission-bound so they use the default per-agent
-        // workspace under <install>/agents/<alias>/workspace/.
+        // Ad-hoc team-wizard teams aren't mission-bound, so they use the
+        // default per-agent workspace under <install>/agents/<alias>/workspace/.
         provisioner
-            .provision_claw(claw_id, &m.model, risk, None)
+            .provision_claw(claw_id, &m.model, risk)
             .await
             .map_err(|e| {
                 eprintln!("teams: provision claw {claw_id} failed: {e}");