fix(mission_runtime): per-mission auto-pair via container log scrape (C3 auth)

The seed-mount approach didnt work: even with the shared runtimes
data dir bind-mounted, a fresh gateway instance mints a new pairing
key and requires re-pairing. The topology_worker connect returned
401 forever.

New approach — per-mission gateways self-pair:
- Provisioner tails container logs after start, extracts the
  X-Pairing-Code from the boot banner
- Persists it on missions.runtime_pairing_code (migration 0059)
- topology_worker constructs ZeroClawDriveExecutor with THAT code
  via from_env_for_gateway_with_code, which triggers the lazy
  /pair handshake on first turn and caches the returned bearer

Drops the shared-runtime data-dir mount — each per-mission gateway
now owns its own state, restoring the C3 isolation guarantee.

crates/cm-api/src/mission_orchestrator.rs

@@ -72,14 +72,15 @@ pub async fn on_launch(
     // shared runtime endpoint in that case.
     if let Some(prov) = crate::mission_runtime::MissionRuntimeProvisioner::from_env() {
         match prov.ensure_container(mission_id).await {
-            Ok(endpoint) => {
+            Ok(ec) => {
                 let container_name = crate::mission_runtime::container_name(mission_id);
                 if let Err(e) = cm_db::repo::missions::set_runtime_binding(
                     pool,
                     mission_id,
                     workspace_id.as_uuid(),
                     Some(&container_name),
-                    Some(&endpoint),
+                    Some(&ec.endpoint),
+                    ec.pairing_code.as_deref(),
                 )
                 .await
                 {
@@ -88,7 +89,9 @@ pub async fn on_launch(
                     );
                 } else {
                     eprintln!(
-                        "mission_orchestrator: runtime container {container_name} → {endpoint} for mission {mission_id}"
+                        "mission_orchestrator: runtime container {container_name} → {} (paired={}) for mission {mission_id}",
+                        ec.endpoint,
+                        ec.pairing_code.is_some()
                     );
                 }
             }