Expand axis wildcards in live runtime incidents

Description

A live control-plane runtime incident with an :* target is never expanded: the live closure emits the literal scope (e.g. resource:*) and the shape engine matches scopes exactly, so it moves nothing (found by the SKT-0191 lane with a throwaway test). Scheduled incidents, scenario effects and ad-hoc failures do expand. Expand runtime wildcards with the same helper as load time, on every axis.

Acceptance Criteria

• #1 A live :* incident moves every target on that axis (resource:* only the mode’s kind), red then green
• #2 Exact-target live incidents unchanged

Definition of Done

• #1 just check (fmt-check, lint, gen-check, env-check, docs-check, test, race, hygiene, ui-check, compose-check, helm-test, lab-check, signal-fidelity)
• #2 just gen (only if a blueprint field, construct/workload config struct, or a skill under plugins/synthkit/skills/ changed)
• #3 just dump — inventory diffed against signals/