fix: registry gaps (runtime filter, utils/lib deps, paths+target, type-only cycles) → 2.0.2

[alexy-os]

Summary

Fixes four gaps found while validating per-runtime registries (r/<svelte|react|vue>/) with the real CLI. Version bumped to 2.0.2 on this branch only (not published, no tag/release).

1. Runtime filter dropped *.types.ts → --runtime / config.runtime now always keeps *.types.ts, *.types.tsx, *.d.ts and every file of the same item that a kept file imports (relative, transitive, extension/index resolution). A file imported by a selected file is never dropped. (init --framework none workaround no longer needed.)
2. registry:utils / registry:lib not resolved via registryDependencies → utils, utils/<n>, lib/<n> (and bare lib names in index.json) resolve against utils/<n>.json / lib/<n>.json and are installed by add if missing. Catalog exclusion (picker / --all list) is kept; explicit names and dependencies are no longer filtered. Dependency-only utils/lib never overwrite existing files (even with --force). init core install unchanged.
3. paths ignored when a file sets target → precedence: add --path key=dir (new, repeatable) > config.paths mapped by target prefix > file target. Unchanged when no paths apply. Documented in docs/configuration.md.
4. Type-only cycles (feature-grid ↔ feature-cards, section-frame ↔ section-header) → no default warning, each item installed once, back edges no longer disturb order; --verbose lists type-only edges; value-only cycles get one concise warning.

Also: registry item cache is namespaced per --registry-url (two registries no longer share cached items by name). strictCdn / registryUrl unchanged (tests added).

Tests

• Unit/integration (vitest): tests/utils/runtime-files.test.ts, tests/registry/typed-dependencies.test.ts, tests/utils/paths.test.ts, tests/utils/dependency-resolver.test.ts, tests/commands/add-fixture-registry.test.ts (svelte+react), using a generated synthetic fixture registry (tests/fixtures/build-fixture-registry.mjs). No private content.
• E2E: npm run test:e2e (scripts/e2e-fixture-registry.mjs) builds temp projects and runs the built CLI init/add for svelte and react. Fails on main (21 checks), passes here.
• Gates: type-check ✅, build ✅, npm test 170 passed ✅, e2e ✅, pack:check ✅ (no lint configured).

Breaking-risk points

• add name/dependency fetches no longer apply excludeTypes (existing add-cdn test updated); ui8kit add utils|presets now works instead of "not found".
• paths now affects files with target (previously ignored): users with paths set will see new locations; relative imports are not rewritten, so remap at same depth.
• Runtime filter keeps more files than before (types + imported files).
• Cycle warnings removed from default output (scripts grepping for them).
• New cache key scope when --registry-url is set (one-time cache miss).

Not included

• CI workflow step for the e2e script: the bot's token lacks the workflow scope; suggested line after npm run build: - run: node scripts/e2e-fixture-registry.mjs.
• No publish, tag, or release.