missions: sweeper + socket-proxy NETWORKS grant + mount ordering (C3 slice 4-5)

- mission_runtime::spawn_sweeper: force-removes runtime containers
  for missions terminal for >=30 min, clears runtime_endpoint. Wired
  into clawmates-server main().
- docker-compose socket-proxy: NETWORKS=1 so bollard.connect_network
  can attach containers to clawmates_edge for provider egress.
- phase_runner ordering: ensure_checkout BEFORE ensure_container so
  the mission dir exists before docker mounts it.
- provisioner: mkdir_p the mission dir defensively for research-only
  missions that skip checkout entirely.

crates/bins/clawmates-server/src/main.rs

@@ -289,6 +289,10 @@ async fn run() -> Result<(), String> {
     // rows so the canvas renders a live status timeline.
     cm_api::task_card_worker::spawn(pool.clone());
     cm_api::phase_runner::spawn(pool.clone());
+    // Per-mission runtime container sweeper (C3): tears down mission
+    // runtime containers 30 min after the mission reaches a terminal
+    // state so operators have a window to pull final artifacts.
+    cm_api::mission_runtime::spawn_sweeper(pool.clone(), std::time::Duration::from_secs(30 * 60));
     // PDF renderer worker (Slice 6): watches mission_artifacts for
     // MD entries with render_pdf_status='pending', calls the
     // configured LLM (default Gemini 2.5 Flash) for styled HTML,