Recursive deploy ladder: Company + Org tiers, mesh mark, two-tier rail

Completes the scale ladder (single → team → company → org). Every tier is a
topology whose nodes are the tier below; running a parent recursively runs each
child's sub-topology down to the leaf claws.

Backend:
- migration 0011: companies/company_teams, orgs/org_companies, topology_runs.tier
- cm-db repos for companies + orgs (mirror teams)
- TurnRequest.attrs (forwarded from node.attrs) for child-id binding
- SubTopologyExecutor (recursive_exec.rs): a parent "turn" runs the child's
  sub-topology; durability via parent updated_at keepalive + cancel propagation
  + depth cap; boxed future breaks the org→company recursion
- topology_worker selects executor by job.tier
- routes: /api/companies, /api/orgs (create/list/get/run) + unified
  /api/structure/{level}/{id} for the zoom canvas

Frontend:
- MeshMark: node-mesh brand glyph (replaces the claw PNG), tier variants
- TopologyGraphView: optional onNodeClick/nodeMeta + dark-token theming
- StructureCanvas + Breadcrumb: one recursive zoom view for every tier
  (drill down on node click, breadcrumb up); TeamRunPanel extracted + shared
- two-tier Discord-style rail: StructureRail (mesh mark + org/company/team
  glyphs + tools popover + deploy + user) | RosterColumn (selected group's
  children, or your claws); SecondaryNav for cross-cutting tools
- ComposeWizard (company/org) wired into DeployWizard; /companies + /orgs pages

Co-Authored-By: Claude Opus 4.8 <[email protected]>

crates/cm-db/src/repo/companies.rs

@@ -0,0 +1,151 @@
+//! Persistence for companies — a baseline topology staffed with real workspace
+//! teams (the 3rd rung of the deploy ladder). `companies` holds the topology
+//! graph; `company_teams` is the durable node→team binding. Mirrors `teams`
+//! one tier up: where a team binds nodes to claws, a company binds nodes to
+//! whole teams, and the recursive executor runs each bound team's sub-topology.
+
+use cm_domain::WorkspaceId;
+use serde_json::Value;
+use sqlx::PgPool;
+use time::OffsetDateTime;
+use uuid::Uuid;
+
+use crate::DbError;
+
+/// A company row summary (list view).
+pub struct CompanySummary {
+    pub id: Uuid,
+    pub name: String,
+    pub kind: String,
+    pub status: String,
+    pub created_at: OffsetDateTime,
+}
+
+/// A full company (graph + metadata).
+pub struct Company {
+    pub id: Uuid,
+    pub name: String,
+    pub kind: String,
+    pub graph: Value,
+    pub status: String,
+    pub created_at: OffsetDateTime,
+}
+
+/// A node→team binding within a company.
+pub struct CompanyTeam {
+    pub node_id: String,
+    pub team_id: Uuid,
+    pub role: String,
+}
+
+/// Insert a company (the topology graph). Members are added separately.
+pub async fn insert_company(
+    pool: &PgPool,
+    id: Uuid,
+    workspace_id: WorkspaceId,
+    name: &str,
+    kind: &str,
+    graph: &Value,
+) -> Result<(), DbError> {
+    sqlx::query!(
+        "INSERT INTO companies (id, workspace_id, name, kind, graph)
+         VALUES ($1, $2, $3, $4, $5)",
+        id,
+        workspace_id.as_uuid(),
+        name,
+        kind,
+        graph,
+    )
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+/// Bind a team to a topology node within a company.
+pub async fn add_team(
+    pool: &PgPool,
+    company_id: Uuid,
+    node_id: &str,
+    team_id: Uuid,
+    role: &str,
+) -> Result<(), DbError> {
+    sqlx::query!(
+        "INSERT INTO company_teams (company_id, node_id, team_id, role)
+         VALUES ($1, $2, $3, $4)",
+        company_id,
+        node_id,
+        team_id,
+        role,
+    )
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+/// The most recent companies for a workspace, newest first.
+pub async fn list_for_workspace(
+    pool: &PgPool,
+    workspace_id: WorkspaceId,
+    limit: i64,
+) -> Result<Vec<CompanySummary>, DbError> {
+    let rows = sqlx::query!(
+        "SELECT id, name, kind, status, created_at FROM companies
+         WHERE workspace_id = $1 ORDER BY created_at DESC LIMIT $2",
+        workspace_id.as_uuid(),
+        limit,
+    )
+    .fetch_all(pool)
+    .await?;
+    Ok(rows
+        .into_iter()
+        .map(|r| CompanySummary {
+            id: r.id,
+            name: r.name,
+            kind: r.kind,
+            status: r.status,
+            created_at: r.created_at,
+        })
+        .collect())
+}
+
+/// A single company, workspace-scoped.
+pub async fn get(pool: &PgPool, id: Uuid, workspace_id: WorkspaceId) -> Result<Company, DbError> {
+    let row = sqlx::query!(
+        "SELECT id, name, kind, graph, status, created_at FROM companies
+         WHERE id = $1 AND workspace_id = $2",
+        id,
+        workspace_id.as_uuid(),
+    )
+    .fetch_optional(pool)
+    .await?
+    .ok_or(DbError::NotFound)?;
+    Ok(Company {
+        id: row.id,
+        name: row.name,
+        kind: row.kind,
+        graph: row.graph,
+        status: row.status,
+        created_at: row.created_at,
+    })
+}
+
+/// The node→team bindings for a company.
+pub async fn teams_for_company(
+    pool: &PgPool,
+    company_id: Uuid,
+) -> Result<Vec<CompanyTeam>, DbError> {
+    let rows = sqlx::query!(
+        "SELECT node_id, team_id, role FROM company_teams WHERE company_id = $1 ORDER BY node_id",
+        company_id,
+    )
+    .fetch_all(pool)
+    .await?;
+    Ok(rows
+        .into_iter()
+        .map(|r| CompanyTeam {
+            node_id: r.node_id,
+            team_id: r.team_id,
+            role: r.role,
+        })
+        .collect())
+}