fix(claws): point per-mission workspace at /mission/repo + tool-inventory preamble

Two stacked issues after risk_profile was fixed:

1. Claws had file_edit + 46 other tools available, but the templates
   trained the agents to expect file_read/file_write (older ZeroClaw
   tool names). Result: agent output kept saying "I only have file_read"
   and dumped implementations into the context window as text.

2. Even with file_edit, the sandbox pointed at
   /zeroclaw-data/.zeroclaw/agents/<alias>/workspace/ — NOT
   /mission/repo where the checked-out mission repo actually lives.
   unrestricted_filesystem=false blocked agents from reaching it.

Fixes:
- provision_claw now takes workspace_path. mission_orchestrator passes
  /mission/repo — pins the per-claw workspace via
  agents.<alias>.workspace.path to the bind-mount path so file_edit /
  content_search / glob_search operate on the mission's git checkout.
- phase_task_text prepends an explicit tool inventory (file_edit,
  content_search, glob_search, git_operations, git_forge, ...) plus a
  WORKSPACE line pinned at /mission/repo. Each phase directive is
  rewritten to reference file_edit / git_operations explicitly and to
  call out "do NOT paste code in your reply expecting the platform to
  save it."

crates/cm-api/src/mission_orchestrator.rs

@@ -333,8 +333,18 @@ async fn mint_team_from_template(
         // etc.). Passing "toolfree" — the old default — left every
         // agent with zero tools regardless of what its prompt asked for.
         if let Some(p) = provisioner {
+            // /mission/repo is the bind-mount path inside the per-mission
+            // runtime container (see mission_runtime::ensure_container).
+            // Pinning workspace.path there lets file_edit / glob_search /
+            // content_search actually operate on the mission's checked-out
+            // repo instead of the empty per-agent sandbox.
             if let Err(e) = p
-                .provision_claw(claw_id, default_model, &template.template.risk_profile)
+                .provision_claw(
+                    claw_id,
+                    default_model,
+                    &template.template.risk_profile,
+                    Some("/mission/repo"),
+                )
                 .await
             {
                 eprintln!(