Expand rule actions for per-repo tasks

Add safe action interpolation and for_each binding for rule fan-out, update the weekly SBOM definition, cover the new evaluation path, and reconcile activity-core scope/workplans for the State Hub sync.

src/activity_core/models.py

@@ -92,6 +92,14 @@ class ActionDef(BaseModel):
 
 class RuleDef(BaseModel):
     id: str
+    for_each: str | None = Field(
+        default=None,
+        description="Optional event/context path to a list for per-item rule expansion.",
+    )
+    bind_as: str = Field(
+        default="item",
+        description="Context key used for each item when for_each is set.",
+    )
     condition: str = Field(
         default="",
         description="Rule DSL expression; empty string means always true.",