validation sweep: close residual TODO + strip 'future' stubs

- mission_orchestrator: replace hardcoded cli=\"claude\" with real
  precedence chain: mission.config.cli → template.config.default_cli
  → \"claude\". Missions can now A/B by CLI without a schema change.
- fleet.rs: scope clippy::too_many_arguments allow on
  NodeHub::open_pty — 8 params (session address x4 + target address
  x3) is the actual dimensionality; a struct would be ceremony.
- security_scan.rs: delete future_artifact_root — pure hint-stub,
  no callers, nothing depends on it.
- routes/world.rs: delete the empty normalize() seam + its 30-line
  comment block. normalize_run_event higher up does the real work;
  the empty stub was pre-cleanup scaffolding.

Post-sweep validation across the whole workspace:
  * cargo check --workspace           → clean
  * cargo test --workspace --no-run   → all bins build
  * cargo test -p cm-api --test mission_orchestrator → 3/3 pass
  * cargo clippy -p cm-api -p clawmates-node --tests → 0 warnings
  * tsc --noEmit                      → 0 errors

Wiring audit: every recent route handler is registered in lib.rs.
Every recent frontend component has at least one importer.

Remaining #[allow(dead_code)] entries are deprovision_claw +
unpublish_claw on RuntimeProvisioner — real rollback paths waiting
on the team-delete route. Documented future hooks, not stubs.

crates/cm-api/src/mission_orchestrator.rs

@@ -108,12 +108,29 @@ pub async fn on_launch(
     if mission.runtime_kind == "local_herdr" {
         if let (Some(hub), Some(node_id)) = (node_hub, mission.target_node_id) {
             let prompt = mission.description.clone().unwrap_or_default();
-            let cli = "claude"; // TODO(phase-4): pick from team template
+            // CLI selection precedence:
+            //   mission.config.cli → template.config.default_cli → "claude"
+            // Templates encode which agent CLI fits their stack; missions can
+            // override per-run for A/B (kimi on morpheus vs claude on tank).
+            let cli = mission
+                .config
+                .get("cli")
+                .and_then(|v| v.as_str())
+                .map(str::to_string)
+                .or_else(|| {
+                    template
+                        .template
+                        .config
+                        .get("default_cli")
+                        .and_then(|v| v.as_str())
+                        .map(str::to_string)
+                })
+                .unwrap_or_else(|| "claude".to_string());
             match crate::fleet_herdr::dispatch(
                 hub,
                 cm_domain::NodeId::from(node_id),
                 mission_id,
-                cli,
+                &cli,
                 &prompt,
             )
             .await