Expand rule actions for per-repo tasks

Add safe action interpolation and for_each binding for rule fan-out, update the weekly SBOM definition, cover the new evaluation path, and reconcile activity-core scope/workplans for the State Hub sync.

src/activity_core/activities.py

@@ -24,10 +24,10 @@ from activity_core.db import make_engine
 from activity_core.issue_sink import get_issue_sink
 from activity_core.orm import ActivityDefinition as ActivityDefinitionRow
 from activity_core.orm import ActivityRun, TaskInstance, TaskSpawnLog
-from activity_core.rules import evaluate_condition
 from activity_core.llm_client import get_llm_client
 from activity_core.models import InstructionDef
 from activity_core.report_sinks import persist_reports
+from activity_core.rules.actions import expand_rule_actions
 from activity_core.rules.executor import execute_instruction_with_audit
 
 
@@ -241,9 +241,8 @@ async def persist_task_instance(task_payload: dict) -> str:
 
 @activity.defn
 async def evaluate_rules(payload: dict) -> list[dict]:
-    """Evaluate each rule condition against the event and context.
+    """Evaluate rules and render matching actions as task specs.
 
-    Returns the list of matching rule dicts (those whose condition is True).
     Rules that raise UnsafeExpression or any other error are skipped and logged.
 
     Expected keys in payload:
@@ -268,18 +267,16 @@ async def evaluate_rules(payload: dict) -> list[dict]:
 
     event_obj = _Env(event_attrs)
 
-    matched: list[dict] = []
+    task_specs: list[dict] = []
     for rule in rules:
-        condition = rule.get("condition", "")
         try:
-            if evaluate_condition(condition, event_obj, context):
-                matched.append(rule)
+            task_specs.extend(expand_rule_actions([rule], event_obj, context))
         except UnsafeExpression as exc:
             activity.logger.warning("rule %r unsafe expression — skipping: %s", rule.get("id"), exc)
         except Exception as exc:
             activity.logger.warning("rule %r eval error — skipping: %s", rule.get("id"), exc)
 
-    return matched
+    return task_specs
 
 
 @activity.defn