Recursive deploy ladder: Company + Org tiers, mesh mark, two-tier rail

Completes the scale ladder (single → team → company → org). Every tier is a
topology whose nodes are the tier below; running a parent recursively runs each
child's sub-topology down to the leaf claws.

Backend:
- migration 0011: companies/company_teams, orgs/org_companies, topology_runs.tier
- cm-db repos for companies + orgs (mirror teams)
- TurnRequest.attrs (forwarded from node.attrs) for child-id binding
- SubTopologyExecutor (recursive_exec.rs): a parent "turn" runs the child's
  sub-topology; durability via parent updated_at keepalive + cancel propagation
  + depth cap; boxed future breaks the org→company recursion
- topology_worker selects executor by job.tier
- routes: /api/companies, /api/orgs (create/list/get/run) + unified
  /api/structure/{level}/{id} for the zoom canvas

Frontend:
- MeshMark: node-mesh brand glyph (replaces the claw PNG), tier variants
- TopologyGraphView: optional onNodeClick/nodeMeta + dark-token theming
- StructureCanvas + Breadcrumb: one recursive zoom view for every tier
  (drill down on node click, breadcrumb up); TeamRunPanel extracted + shared
- two-tier Discord-style rail: StructureRail (mesh mark + org/company/team
  glyphs + tools popover + deploy + user) | RosterColumn (selected group's
  children, or your claws); SecondaryNav for cross-cutting tools
- ComposeWizard (company/org) wired into DeployWizard; /companies + /orgs pages

Co-Authored-By: Claude Opus 4.8 <[email protected]>

crates/cm-api/src/mcp_door.rs

@@ -30,10 +30,8 @@ const MCP_PROTOCOL_VERSION: &str = "2024-11-05";
 /// Tools the door exposes, as `(mcp_name, internal_registry_name)`. The agent
 /// sees `clawmates__<mcp_name>`; ZeroClaw strips the prefix and calls us with
 /// `<mcp_name>`. We keep MCP names underscore-only (some models choke on dots).
-const EXPOSED_TOOLS: &[(&str, &str)] = &[
-    ("email_send", "email.send"),
-    ("slack_post", "slack.post"),
-];
+const EXPOSED_TOOLS: &[(&str, &str)] =
+    &[("email_send", "email.send"), ("slack_post", "slack.post")];
 
 fn internal_name(mcp_name: &str) -> Option<&'static str> {
     EXPOSED_TOOLS
@@ -253,7 +251,11 @@ pub async fn mcp(
 
         "tools/list" => {
             if authed(&state, &headers).await.is_none() {
-                return err(req.id, -32001, "unauthorized: missing or invalid bearer token");
+                return err(
+                    req.id,
+                    -32001,
+                    "unauthorized: missing or invalid bearer token",
+                );
             }
             let tools: Vec<Value> = EXPOSED_TOOLS
                 .iter()
@@ -270,11 +272,18 @@ pub async fn mcp(
 
         "tools/call" => {
             let Some(user) = authed(&state, &headers).await else {
-                return err(req.id, -32001, "unauthorized: missing or invalid bearer token");
+                return err(
+                    req.id,
+                    -32001,
+                    "unauthorized: missing or invalid bearer token",
+                );
             };
             let params = req.params.clone().unwrap_or_else(|| json!({}));
             let mcp_name = params.get("name").and_then(|v| v.as_str()).unwrap_or("");
-            let args = params.get("arguments").cloned().unwrap_or_else(|| json!({}));
+            let args = params
+                .get("arguments")
+                .cloned()
+                .unwrap_or_else(|| json!({}));
 
             let Some(internal) = internal_name(mcp_name) else {
                 return tool_result(
@@ -307,9 +316,15 @@ pub async fn mcp(
             let agent_id = match cm_db::repo::agents::roster(&state.pool, user.workspace_id).await {
                 Ok(roster) if !roster.is_empty() => roster[0].id,
                 Ok(_) => {
-                    return tool_result(req.id, true, "no agent in workspace to act on behalf of".into())
+                    return tool_result(
+                        req.id,
+                        true,
+                        "no agent in workspace to act on behalf of".into(),
+                    )
+                }
+                Err(_) => {
+                    return tool_result(req.id, true, "failed to resolve workspace agent".into())
                 }
-                Err(_) => return tool_result(req.id, true, "failed to resolve workspace agent".into()),
             };
 
             // Broker-executed tools (e.g. slack.post) need a single-use grant
@@ -329,7 +344,13 @@ pub async fn mcp(
 
             match state
                 .runtime
-                .execute_door_tool(user.workspace_id, agent_id, internal, args.clone(), approval_id)
+                .execute_door_tool(
+                    user.workspace_id,
+                    agent_id,
+                    internal,
+                    args.clone(),
+                    approval_id,
+                )
                 .await
             {
                 Ok(output) => {