fix(flr): partition-rooted FLR paths + agent/intent in checkpoint names (#2)

skills/zerto-rewind/SKILL.md

@@ -14,7 +14,7 @@ You talk to **one** MCP: `zerto_rewind_mcp`. Do not also require official ZVM MC
 Before **every** guest-mutating tool call:
 
 1. Take the hostname / VM name / Zerto `vmIdentifier` from the tool args.
-2. Call `zerto_guard_before_mutate` (or `zerto_find_protection` then `zerto_create_tagged_checkpoint`).
+2. Call `zerto_guard_before_mutate` with `change_id` and `action` (or `zerto_find_protection` then `zerto_create_tagged_checkpoint`).
 3. If `ok` is not true: **stop**. Do not mutate.
 4. Then run the mutating call.
 
@@ -51,4 +51,16 @@ Human must confirm. Pass `confirmed=true` only after they say yes.
 
 ## Tag
 
-Default: `ai:<agent>:<change-id>:<utc>`. Same string on every VPG for that call.
+The checkpoint name is the only field the Zerto API takes, so it carries the
+whole story:
+
+```
+ai:<agent> | <action> | vm=<vm> | change=<change-id> | <utc>
+ai:claude | edit /etc/nginx/nginx.conf | vm=web01 | change=chg-412 | 20260921T150405Z
+```
+
+Always pass `action`: a plain description of the change you are about to make.
+An operator scrolling the journal in the Zerto UI should be able to tell which
+agent inserted the checkpoint and why, without reading your transcript.
+
+Same string on every VPG for that call.