Rebrand: TeamClaw -> Clawmates (clawmates.work)

Full-depth rename per the approved plan; the 'claw' product vocabulary
(claws, /claws routes, clawId, Claw Chat) stays — it is now the brand.

- Display brand: Clawmates (manifest, titles, hero, login/rail logo
  'clawmates'); default host app.clawmates.work; registry
  ghcr.io/clawmates
- Crates tc-* -> cm-* (16 crates + all imports); binaries
  clawmates-server/broker/bundler; images clawmates/*; env prefix
  CLAWMATES_* (+ CM_TEST_DATABASE_URL / CM_LIVE_LLM); config
  clawmates.toml; helm chart deploy/helm/clawmates with clawmates-*
  resources; db names clawmates*; sockets /run/clawmates; cookie
  cm_session; kind cluster clawmates-test; seccomp node profile
  clawmates-agent-profile.json
- All 9 Playwright brand assertions updated in lockstep; historical
  spec document left untouched as the only remaining 'TeamClaw'
- Local env migrated: dev pg clawmates-dev-pg/clawmates_dev, shared
  test server clawmates-test-pg, kind cluster recreated with image +
  profile, compose images rebuilt under clawmates/*

Verified end to end: 161 Rust + 68 frontend tests, 29 Playwright
journeys, 4 live kind tests, helm/install/LOC/placeholder gates, and
the clean-room install rehearsal serving the clawmates login page from
a signed bundle of the rebuilt images.

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/cm-safety/src/checkpoint.rs

@@ -0,0 +1,47 @@
+use sqlx::PgPool;
+use uuid::Uuid;
+
+use crate::SafetyError;
+
+/// Suspends a run: persists the full serialized loop state and flips the
+/// run to `awaiting_approval` atomically.
+pub async fn suspend(
+    pool: &PgPool,
+    run_id: Uuid,
+    state: &serde_json::Value,
+) -> Result<(), SafetyError> {
+    let result = sqlx::query!(
+        "UPDATE agent_runs
+         SET checkpoint = $2, state = 'awaiting_approval', updated_at = now()
+         WHERE id = $1",
+        run_id,
+        state,
+    )
+    .execute(pool)
+    .await?;
+    if result.rows_affected() == 0 {
+        return Err(SafetyError::NotFound);
+    }
+    Ok(())
+}
+
+pub async fn load(pool: &PgPool, run_id: Uuid) -> Result<serde_json::Value, SafetyError> {
+    let row = sqlx::query!("SELECT checkpoint FROM agent_runs WHERE id = $1", run_id)
+        .fetch_optional(pool)
+        .await?
+        .ok_or(SafetyError::NotFound)?;
+    row.checkpoint.ok_or(SafetyError::NotFound)
+}
+
+/// Claims a suspended run for resumption. The CAS from `awaiting_approval`
+/// to `running` ensures exactly one resumer proceeds.
+pub async fn claim_resume(pool: &PgPool, run_id: Uuid) -> Result<bool, SafetyError> {
+    let result = sqlx::query!(
+        "UPDATE agent_runs SET state = 'running', updated_at = now()
+         WHERE id = $1 AND state = 'awaiting_approval'",
+        run_id,
+    )
+    .execute(pool)
+    .await?;
+    Ok(result.rows_affected() == 1)
+}