feat(admin): loops grouped inside their skill, and graph scope labels (issue #54)

[edgehero]

Operator feedback on the shipped graph: it was not clear which repos or folders it covers, and the loop a skill's own text describes was nowhere to be seen. The second half was a real gap against the original ask — the design carried loop-in-skill markers, but the data layer never produced them.

Loops, grouped inside the skill

findLoopHints (pure, graph-model) scans each SKILL.md body for iteration vocabulary (until, repeat, iterate, for each, while, keep …ing), frontmatter excluded so a description: repeat daily never reads as a loop, deduped, capped at three. Every surface groups the hints inside the skill, because a loop lives inside its one job, one container, one budget slot:

• HTML: a loop-carrying skill renders as a Node-RED group box — tinted rect labelled with the skill, the chip, one ⟳ marker per hint with its phrase, the ring wire contained in the box; sub-skills nest as small chips. External edges still attach to the chip's ports (containment, not a new node).
• TUI: ⟳-glyph badges with the phrase on the skill row. Text: [loop: "…"] badges.

A hint is text evidence, never a promise — the mention discipline, applied to a node's insides.

Which repos and folders

• Forge groups now say what they are about: github · ran against acme/website — the repo half of the id-only record target every runs view already shows, capped at 5, labelled record-derived (a github trigger's config names no repository at all).
• Local folders keep their full path in the TUI and text views. The HTML artifact stays basename-only by default (durable, shareable file) and gains --full-paths, an explicit operator opt-in for the reviewed run.folder paths.

Specs (same PR)

REQ-TOPOLOGY-GRAPH gains (e2); REQ-GRAPH-HTML-EXPORT gains the opt-in with acceptance twins (the default-artifact no-path canary keeps holding); SECURITY.md names the opt-in; GRAPH_LIMITS.maxReposListed literal-pinned; docs/graph.md gains the loops and scope sections.

READMEs and image

Both READMEs' screenshot regenerated from a fixture whose skill actually loops (the group box, the ⟳ marker, and the forge scope line are all visible in it), alt texts updated, image version bumped.

Verification

Suite in the CI posture: 2175 pass, 0 skipped; bundle builds; the artifact re-verified in headless Chrome in both modes; layout invariants extended (chip inside box, ring inside box, markers clear of wires, sub-chips unwired) and mutation-checked.