refactor: the missions root has one definition, not five

`mission_workspace::missions_root()` is now the only place that answers "where
does mission state live". It had fragmented into five: this function, private
`env::var("CLAWMATES_MISSIONS_ROOT")` copies in security_scan, benchmark_runner
and mission_outputs, and a hardcoded `MISSIONS_HOST_ROOT` const in
mission_runtime that read no env at all.

They agree on the deployed value, so nothing has broken. The risk is entirely
in what comes next: anything that sweeps or reclaims this tree has to be
sweeping the same tree the writers use, and five definitions cannot promise
that — a reaper written against one would silently leave the others' directories
behind forever, which is how the orphans got there in the first place.

A source-walk test fails any module outside `mission_workspace` that reads the
env var itself.

Co-Authored-By: Claude Opus 5 <[email protected]>

crates/cm-api/src/mission_outputs.rs

@@ -305,9 +305,7 @@ pub fn outputs_root_dir() -> PathBuf {
 }
 
 fn missions_root() -> PathBuf {
-    std::env::var("CLAWMATES_MISSIONS_ROOT")
-        .map(PathBuf::from)
-        .unwrap_or_else(|_| PathBuf::from("/var/lib/clawmates-missions"))
+    crate::mission_workspace::missions_root()
 }
 
 fn mime_for(p: &Path) -> &'static str {