-- Per-mission ZeroClaw pairing code.
--
-- Fresh mission runtime containers mint a new one-time pairing code
-- at startup. mission_runtime::ensure_container captures it from the
-- container's stdout and persists it here so the topology_worker's
-- ZeroClawDriveExecutor can lazy-pair with THIS gateway (instead of
-- reusing the shared runtime's env-derived ZEROCLAW_TOKEN, which the
-- fresh gateway doesn't accept).
--
-- Nullable: pre-C3-pair missions + non-mission topology runs fall
-- back to the shared-runtime env auth path.

ALTER TABLE missions ADD COLUMN runtime_pairing_code TEXT;