phase_runner: ensure repo checkout on every phase launch

Moves ensure_checkout into launch_phase so retries + new phase
launches all trigger the clone/fetch. mission_orchestrator still
does its own checkout at initial launch time, so first-launch
timing is unchanged; this covers the retry + additional-phase
paths.

crates/cm-api/src/phase_runner.rs

@@ -142,6 +142,28 @@ async fn launch_phase(
         return Ok(());
     }
 
+    // Ensure the mission's repo is checked out before firing any run.
+    // Idempotent: fetch+reset on existing clones, clone on missing.
+    // Runs on EVERY phase launch — including retries — so a retry
+    // after a failed clone (permissions/auth fixed) will now succeed.
+    // Non-fatal: research-only missions have no repo and skip cleanly.
+    match crate::mission_workspace::ensure_checkout(
+        pool,
+        cm_domain::WorkspaceId::from(workspace_id),
+        mission_id,
+    )
+    .await
+    {
+        Ok(Some(path)) => eprintln!(
+            "phase_runner: repo checked out at {} for mission {mission_id} phase {phase_id}",
+            path.display()
+        ),
+        Ok(None) => {}
+        Err(e) => eprintln!(
+            "phase_runner: repo checkout for mission {mission_id} phase {phase_id} failed (continuing): {e}"
+        ),
+    }
+
     let task = phase_task_text(kind, title, description);
 
     // Purge prior failed / cancelled runs for this phase so the card