validation sweep: close residual TODO + strip 'future' stubs

- mission_orchestrator: replace hardcoded cli=\"claude\" with real
  precedence chain: mission.config.cli → template.config.default_cli
  → \"claude\". Missions can now A/B by CLI without a schema change.
- fleet.rs: scope clippy::too_many_arguments allow on
  NodeHub::open_pty — 8 params (session address x4 + target address
  x3) is the actual dimensionality; a struct would be ceremony.
- security_scan.rs: delete future_artifact_root — pure hint-stub,
  no callers, nothing depends on it.
- routes/world.rs: delete the empty normalize() seam + its 30-line
  comment block. normalize_run_event higher up does the real work;
  the empty stub was pre-cleanup scaffolding.

Post-sweep validation across the whole workspace:
  * cargo check --workspace           → clean
  * cargo test --workspace --no-run   → all bins build
  * cargo test -p cm-api --test mission_orchestrator → 3/3 pass
  * cargo clippy -p cm-api -p clawmates-node --tests → 0 warnings
  * tsc --noEmit                      → 0 errors

Wiring audit: every recent route handler is registered in lib.rs.
Every recent frontend component has at least one importer.

Remaining #[allow(dead_code)] entries are deprovision_claw +
unpublish_claw on RuntimeProvisioner — real rollback paths waiting
on the team-delete route. Documented future hooks, not stubs.

crates/cm-api/src/routes/world.rs

@@ -587,16 +587,3 @@ pub async fn world_replay(
     ))
 }
 
-// THE NORMALIZE SEAM (future) -------------------------------------------------
-// Translate one durable `run_events` row into zero+ taxonomy events, the Rust
-// twin of the handoff bridge's normalize(). Wire this into the poll loop above
-// once the runner emits node targets:
-//   turn.started   -> agent.status(working) [+ agent.task.update]
-//   turn.token     -> agent.reasoning.delta
-//   tool.invoked   -> agent.tool.call [+ world.touch if a nodeId is present]
-//   door.requested -> door.request ; door.resolved -> door.resolve
-//   agent.message  -> agent.message ; runner.telemetry -> telemetry
-#[allow(dead_code)]
-fn normalize(_event_type: &str, _payload: &Value) -> Vec<(&'static str, Value)> {
-    Vec::new()
-}