fix(taint): record taint.hosts once per phase, not once per sweep tick

The container drain revisits finished phases for 30 minutes; the other drains
are idempotent because they truncate, and the taint file deliberately is not.
The first live mission (01a0cb7e) recorded the same event four times. Record
only when no event for the phase already carries at least as many hosts.

Live result otherwise as designed: curl https://example.com tainted iana.org
(the page's link), not example.com (the agent's own target), and grep -rn curl
added nothing.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

crates/cm-api/src/container_tool_hooks.rs

@@ -482,6 +482,24 @@ mod tests {
         );
     }
 
+    /// The taint file is never cleared, so its record needs its own
+    /// once-per-phase guard. Measured without one: the first live mission
+    /// recorded the same `taint.hosts` event four times, and the sweep that
+    /// revisits a finished phase for 30 minutes would have kept going.
+    #[test]
+    fn the_taint_record_is_written_once_per_phase() {
+        let runner = include_str!("phase_runner.rs");
+        let body = runner
+            .split("drain_taint(&docker, &container).await")
+            .nth(1)
+            .expect("the sweep drains the taint file");
+        let guard = body.find("SELECT EXISTS").expect("no once-per-phase guard");
+        let record = body.find("TAINT_HOSTS,\n").unwrap_or(usize::MAX).min(
+            body.find("MissionEvent::new").expect("the record"),
+        );
+        assert!(guard < record, "the guard must run before the record is written");
+    }
+
     /// The drain must use the connector that honours DOCKER_HOST.
     ///
     /// The server reaches Docker through a socket proxy, so