adopt-project.py and scaffold-project.py: the Free-plan secrets hint follows the legs' visibility (adopt) or names the legs as its reason (scaffold), though the root's visibility decides it #602

L2-17 (P3; adopt-project.py, #565 review): adopt keys the Free-plan secrets hint to the two new legs, but the workflow that reads the secrets runs in the adopted root, which keeps its own visibility.

• adopt-project.py:7131-7138 at fdb0fa5: visibility = plan.get("visibility", "private") decides the NOTE and the free_plan_secret_hint(...) call. The hint says org secrets "resolve to EMPTY inside the workflow" and offers repository secrets or an upgrade to Team, which holds only when the root is private or internal. A public source adopted with private legs prints it anyway. templates/assembly-root/project.yaml:57-62 says the adopted root keeps whatever visibility it had.
• scaffold-project.py: a leg gh sees and git cannot read is refused scaffold-remote-exists with git's terminal prompt off, and the reuse re-run's visibility lines go by each leg as it stands (#542) #565's fix round (review F1) keys the scaffold's hint to the root's own visibility, so after it the two tools disagree. This one predates scaffold-project.py: a leg gh sees and git cannot read is refused scaffold-remote-exists with git's terminal prompt off, and the reuse re-run's visibility lines go by each leg as it stands (#542) #565.
• Direction: print the hint only when the adopted root is private or internal, reading its visibility from GitHub as _leg_visibility does for a reused root (scaffold-project.py:982), and keep the per-leg NOTE.

— #457, comment

L2-44 (nit; scaffold-project.py, #565 re-verify): the Free-plan hint is now printed only when the root is closed, but it still names the closed legs as the reason.

• scaffold-project.py:1209-1210 at 6889d99 passes f"{who} {are}", the closed legs, as the hint's subject. FREE_PLAN_HINT (scripts/repo_shape.py:1011-1025) then reads, for a public run over a reused private root and a reused private code leg, "testorg/Atlas-code is private, so org-level SHAPE_LEGS_APP_ID / SHAPE_LEGS_APP_PRIVATE_KEY resolve to EMPTY". The secrets resolve to EMPTY because the root, testorg/Atlas, is private. The facts the hint states are true; the stated reason is not.
• Before scaffold-project.py: a leg gh sees and git cannot read is refused scaffold-remote-exists with git's terminal prompt off, and the reuse re-run's visibility lines go by each leg as it stands (#542) #565 a fresh run gave all three repositories one visibility, so naming the legs was harmless. The mixed-visibility re-runs make it show. The row public-flag-over-private-root pins the leg wording (tests/test_scaffold_reuse_seeded_legs.py:497, :533).
• adopt-project.py:7138-7140 makes the same call with the two legs as the subject. L2-17 on Tracking: adopt-project.py, converting an existing repository in place #457 is the adopt half, so the subject should change in both tools together.
• Direction: pass the root (f"{repositories['assembly']} is") as the subject, and move the pinned test rows with it.

— #459, comment