fix: [ENG-2858] normalize bv-topic related refs in topic-loader

The bv-topic convention uses `related="@domain/topic"` (with `@` prefix,
no `.html` extension), but byPath and the search service both emit
`domain/topic.html`. Without normalization, the alreadyLinkedTo filter
in link-candidates compares `@security/oauth` against
`security/oauth.html` and never matches — so already-linked pairs keep
resurfacing across scans.

This was missed during e2e testing because the smoke sandbox seeded
topics with no related attribute, and the existing unit test passed
pre-normalized values directly into findLinkCandidates, bypassing
topic-loader's parsing. Caught by a fresh review pass on the branch.

topic-loader.ts now:
- strips a leading `@` from each related entry
- appends `.html` when missing

so `t.related` is in the same shape that byPath / search hits use, and
link/merge filtering does what its docstring claims.

Regression coverage in topic-loader.test.ts uses realistic
`related="@security/oauth,@security/cookies"` values; updated the
existing parsing test to assert the canonicalized output.