feat(adapters): sanctioned mission directives injection (#17)

- load-contracts.sh: MOSAIC_MISSION_FILE (readable) appends a MISSION
  (runtime) section — objective + directives — after the immutable
  contracts; unreadable path is a hard error, absent env changes nothing
- mosaic-task.mjs: exports MOSAIC_MISSION_FILE as the run snapshot's
  container path (/var/lib/mosaic/runs/<id>/mission.json), with an
  outside-dataRoot guard; also exports the configured adapter

Verified: contract-only prompt has no mission section; mission-bearing
run shows objective + directives in the generated prompt, snapshot
recorded, real provider returns exactly MOSAIC_HELLO_OK.

Closes #17

scripts/mosaic-task.mjs

@@ -210,12 +210,25 @@ function runTask(taskFile) {
 
   const startedAt = new Date();
   const stderrFile = path.join(runDir, "stderr.txt");
+
+  // Sanctioned mission injection: point the container at the run snapshot's
+  // CONTAINER path (dataRoot maps to /var/lib/mosaic in the image).
+  const spawnEnv = { ...process.env };
+  spawnEnv.MOSAIC_ADAPTER = resolved.execution.adapter;
+  if (task.missionSnapshot) {
+    const relative = path.relative(resolved.dataRoot, runDir);
+    if (relative.startsWith("..") || path.isAbsolute(relative)) {
+      fail(4, `run directory is outside the configured dataRoot: ${runDir}`);
+    }
+    spawnEnv.MOSAIC_MISSION_FILE = `/var/lib/mosaic/${relative.split(path.sep).join("/")}/mission.json`;
+  }
+
   const proc = spawnSync(
     "docker",
     ["compose", "run", "--rm", "-T", "mosaic-agent", task.prompt],
     {
       cwd: PROJECT_ROOT,
-      env: process.env, // MOSAIC_DATA_ROOT / MOSAIC_PROVIDER / MOSAIC_MODEL resolved by run-task.sh
+      env: spawnEnv,
       input: "", // stdin detached: print mode must never wait on a terminal (see issue #5)
       encoding: "utf8",
       maxBuffer: 16 * 1024 * 1024,