fix(export): build Obsidian colorGroup queries with the note-tag sanitizer

[ddy4633]

Closes #2204.

The bug

graphify/export.py writes note tags through _obsidian_tag() (:548) but builds the graph-view colorGroup query with a bare label.replace(' ', '_') (:735). The two paths diverge for any community label containing a character Obsidian rejects in a tag — &, parentheses, a diacritic — which are ordinary in LLM-generated labels (Product & Vale Lookup, Auth (v2)).

The colorGroup then matches no note, so the community renders uncolored in graph view with no warning.

The Dataview queries at :689 and :693 in the same module already use _obsidian_tag(). :735 was the only site that missed it.

The fix

One line, reusing the sanitizer that is already the module's single source of truth, plus a comment explaining why the two must stay in step.

How to test

uv run pytest tests/test_export.py -q      # 51 passed

The new test — test_to_obsidian_color_groups_match_the_tags_written_into_notes — deliberately does not assert exact strings. It asserts that every tag queried by a colorGroup in .obsidian/graph.json actually appears in an exported note. That keeps it valid if _obsidian_tag()'s rules ever change, and it catches drift in either direction.

Regression proof — source change reverted, test kept:

tests/test_export.py:570: in test_to_obsidian_color_groups_match_the_tags_written_into_notes
    assert queried <= written, f"dead colorGroups: {sorted(queried - written)}"
E   AssertionError: dead colorGroups: ['community/Auth_(v2)', 'community/Product_&_Vale_Lookup']

Full suite: 3746 passed, 20 failed, 3 skipped — the 20 failures are identical to the baseline set on a clean tree and are environmental, not related to this change:

• test_skillgen.py ×13 — shallow clone lacks the origin/v8 ref (CI uses fetch-depth: 0)
• test_security.py ×7 — sandbox DNS resolves example.com to 198.18.0.132, tripping validate_url's private-range guard
• test_ollama.py ×2 — an OPENAI_API_KEY present in the environment makes detect_backend() return openai

ruff check clean.

Deliberately out of scope

The issue's closing note about Créditos → Crditos is a separate defect in _obsidian_tag() itself — Obsidian does accept Unicode letters, so the character class is arguably too strict. Fixing that changes the tag values already written into users' existing notes, which is a second logical change and deserves its own PR. Happy to open one if you want it.

Two pre-existing edge cases this PR neither introduces nor resolves:

• Two labels can collapse to the same tag (Auth & Session and Auth Session both → Auth__Session), producing duplicate colorGroup queries. True before and after; the note-side tags already collapse.
• A label that sanitizes to empty ("&&&") yields tag:#community/. After this change it at least matches the note side consistently, but a real fix needs a fallback such as Community {cid}.

Verification limit

I verified that the two code paths now agree and that the queried tags exist in the exported notes. I did not open the export in a real Obsidian vault to confirm the groups render colored — that part rests on the reporter's observation.