Chain flows in a trusted run, and adopt the test step into real flow files

[bennekrouf]

Supersedes #43, which conflicts: PR #42 was squash-merged, so feat/trusted-run shares content with main but not history, and merging replays the already-landed commit. This branch carries only the new work, cherry-picked onto main.

Adopting the test step into flow files that exist

adopt_missing_test_step only upgraded a commit flow byte-identical to the shipped one — which is to say nobody's. A flows.toml in use has a base pinned on preflight and extra nodes on the end, and was silently skipped.

It now matches on shape: any flow with a scan_changes* step and a commit step, and no test step yet, gets one wired between them. Pinned settings, added nodes and labels all survive.

Loosening it needed a guard, or a load-time insert keyed on absence would put the step back every launch after you deleted it. FlowBook gained an adopted: Vec<String> marker, written to flows.toml; load() saves once when it fires. It runs once, ever, and defaults() ships already-adopted.

A trusted run works through the repository, not one flow

Two new pure functions in services::trusted:

• next_flow(book, status) — asks what the repository wants and finds the runnable flow declaring it answers that need, plus which PR to scope a review to.
• may_continue(state, graph) — whether a finished run is one to move on from.

The driver's spawn is now a loop, one flow per turn, re-probing between legs. It stops when nothing needs a person, no flow answers the need, a node failed or was rejected, a merge hold revoked trust, or the next answer is the flow that just ran. A cap of 6 sits behind all of it.

The Trusted run button now enables on next_flow(...).is_some() rather than the selected tab's affordance, so a clean tree with a release due offers it from the Commit → PR tab, naming where it will start. Trusting… and its Stop are keyed on the repository, since the chain moves between keys mid-run.

Tests

344 passing, fmt clean, no new clippy warnings. Seven new for the chain (commit → review → release, a need no flow answers, an unfinished rebase, failed/rejected stopping it, Skipped not stopping it) and seven for the adoption, one of which embeds a real commit_and_pr TOML verbatim.