feat(missions): gate and observe tools on the container tier

The container tier is the one that actually runs missions in production, and
it had neither a tool gate nor tool telemetry. The microVM tier has had both
since yesterday; the tier that matters had neither.

Both gaps have one cause. `claude_cli` runs claude as a subprocess, claude
runs its tools inside that subprocess, and those calls never pass through
ZeroClaw's executor — the only thing that emits TurnEvent::ToolCall and
therefore the only thing the gateway turns into a frame ClawMates can see.
Recovering the calls from the CLI's stream-json output did not help: a real
mission produced zero tool.call events with the parser working perfectly.
The transport was never the problem.

Hooks are the way in, and they are proven. Claude Code reads
hooks.PreToolUse / PostToolUse from the document given to `--settings` and
honours them under `-p` — measured yesterday against the real binary, where
the gate blocked a Bash call, recorded the payload, and got its refusal
reason back to the model.

So the same hook scripts the microVM tier uses are now written into the
mission's container, and the provider is pointed at the settings document
(`--settings` added to claude_cli in the fork, be9c34b1c).

Composed in ONE script for one document: two writers of one settings.json is
a silent clobber, and the microVM tier already learned that expensively.

Installed on BOTH container paths — created and reused. A hook that exists
only on first creation quietly disappears after a server redeploy, and the
container outlives the server process.

Everything degrades to "no hooks", never to a failed mission: a phase that
runs unobserved still delivers; one that fails to start because telemetry
could not be installed delivers nothing.

Four tests, including two that exist because the halves are inert alone: the
installer and the provider prop must both be wired (hooks nobody reads, or a
document nobody wrote), and nothing may be written under /mission/repo,
where it would arrive as part of the agent's delivered diff.

Full workspace suite green: 107 binaries.

Co-Authored-By: Claude Opus 5 <[email protected]>

crates/cm-api/src/lib.rs

@@ -52,6 +52,7 @@ pub mod runtime_preflight;
 pub mod runtime_provision;
 pub mod security_scan;
 pub mod session_executor;
+pub mod container_tool_hooks;
 pub mod gateway_preflight;
 pub mod skill_self_authoring;
 pub mod skill_use;