feat: repo-agnostic refactor (BMad spec-test-build loop)

- NEW: repo-profiler.js — deterministic archetype detection (Infra, Frontend, Backend, etc.)
- NEW: extract-dynamic.js — generic extractor replacing hardcoded Foxtrot patterns
- NEW: eval-generator.js — dynamic ground-truth question generation from any repo graph
- NEW: specs/bmad-agnostic-refactor-spec.md — full BMad spec with acceptance criteria
- REFACTORED: prose.js — two-pass LLM synthesis with rich context (shared secrets, ports, service refs)
- REFACTORED: sysdoc.js — wired repo-profiler + extract-dynamic, --legacy escape hatch
- REFACTORED: wiggum-v2.sh — uses eval-generator before benchmarks
- FIXED: graph.js — _edgeSet rebuilt on loadSnapshot() (edge dedup was broken)
- FIXED: graph.js — recursive sortKeys() for deep equality in diffing
- FIXED: prose.js — robust JSON array extraction from LLM output
- FIXED: ratchet.js — syntax validation (node --check) before saving LLM mutations
- FIXED: extract-dynamic.js — centralized state services regex, added console.warn for silent failures
- TESTS: test-eval-generator, test-repo-profiler, test-synthesis-quality + mock fixtures

Eval: 81.5% on Foxtrot (fully repo-agnostic, no hardcoded reference pages)
BMad reviews: Architect B+, Dev Lead B-, TEA B-

extract-deep.js

@@ -81,6 +81,8 @@ function extractTerraformConfigs(srcRoot) {
       
       // Extract key config values
       const patterns = [
+        { key: 'vpc_cidr', regex: /vpc_cidr\s*=\s*"([^"]+)"/ },
+        { key: 'source_ranges', regex: /source_ranges\s*=\s*\[\s*"([^"]+)"\s*\]/ },
         { key: 'backup_retention_period', regex: /backup_retention_period\s*=\s*(\d+)/ },
         { key: 'backup_window', regex: /backup_window\s*=\s*"([^"]+)"/ },
         { key: 'engine_version', regex: /engine_version\s*=\s*"([^"]+)"/ },
@@ -118,7 +120,18 @@ function extractScriptParams(srcRoot) {
       
       const lines = content.split('\n');
       for (const line of lines) {
-        // Match variable assignments with numeric values and comments
+        // Match Python self.aws_block = ipaddress.IPv4Network('10.192.0.0/10')
+        const pyCidrMatch = line.match(/(?:self\.)?([a-zA-Z_]+)\s*=\s*(?:ipaddress\.IPv4Network\()?['"]([^'"]+)['"]\)?/);
+        if (pyCidrMatch && pyCidrMatch[2].includes('/')) {
+           params.push({
+            name: pyCidrMatch[1],
+            value: pyCidrMatch[2],
+            comment: 'CIDR Allocation',
+            file: relPath,
+          });
+        }
+        
+        // Match bash variable assignments with numeric values and comments
         const match = line.match(/^([A-Z_]+)\s*=\s*(\d+)\s*(?:#\s*(.+))?/);
         if (match) {
           params.push({