docs(turn-loop): document forge + web_tools tool groups in Privileged tools section

The 'Privileged tools (by tool group)' section listed execution,
lifecycle/approvals, scheduling/diagnostics, capability-gated, and
matrix but was missing:

- forge (create_repo) — the only agent path to create a repo under the
  agents/ org; direct token creation is disabled for agents. Opt-in,
  not in any default preset.
- web_tools — enables Claude built-in WebFetch/WebSearch tools. Off by
  default. The tool whitelist section already mentioned these but the
  group was absent from the privileged-tools list.

docs/turn-loop.md

@@ -616,6 +616,17 @@ at_unix_timestamp?)`, `request_next_turn()`.
 - **Scheduling + diagnostics** (`scheduling`, `diagnostics`) —
   scheduled prompts, `get_logs`. See
   [`docs/tools/scheduling.md`](tools/scheduling.md).
+- **Forge repos** (`forge`) — `create_repo` — the only agent path to
+  create a repo under the `agents/` org (direct forge token creation is
+  disabled for agents). The repo is created in the c0re-owned `agents`
+  org; the calling agent gets write collaborator access; the default
+  branch is branch-protected (operator-team must approve merges, so the
+  agent cannot self-merge). Opt-in; not in any default preset.
+  See [`docs/tools/forge.md — Repo management`](tools/forge.md).
+- **Web egress** (`web_tools`) — enables Claude's built-in `WebFetch`
+  and `WebSearch` tools (not MCP tools; added directly to the
+  `--allowedTools` list). Off by default; add the group in the
+  P3RM1SS10NS tab and rebuild to enable.
 - **Capability-gated** — `get_host_journal` (requires
   `read_host_journal` capability set via the P3RM1SS10NS tab;
   orthogonal to tool groups). Full list of capabilities and their