Expand rule actions for per-repo tasks

Add safe action interpolation and for_each binding for rule fan-out, update the weekly SBOM definition, cover the new evaluation path, and reconcile activity-core scope/workplans for the State Hub sync.

tests/test_rule_evaluation_activity.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+import pytest
+
+from activity_core import activities
+
+
+@pytest.mark.asyncio
+async def test_evaluate_rules_returns_interpolated_task_specs() -> None:
+    result = await activities.evaluate_rules({
+        "rules": [
+            {
+                "id": "flag-stale-sbom",
+                "for_each": "context.repos.repos",
+                "bind_as": "repo",
+                "condition": "context.repo.sbom_age_days > 30",
+                "action": {
+                    "task_template": "Run SBOM rescan for {context.repo.repo_slug}",
+                    "target_repo": "context.repo.repo_slug",
+                    "priority": "medium",
+                    "labels": ["sbom", "{context.repo.repo_slug}"],
+                },
+            }
+        ],
+        "event": {},
+        "context": {
+            "repos": {
+                "repos": [
+                    {"repo_slug": "fresh-repo", "sbom_age_days": 5},
+                    {"repo_slug": "stale-repo", "sbom_age_days": 40},
+                ]
+            }
+        },
+    })
+
+    assert len(result) == 1
+    assert result[0]["title"] == "Run SBOM rescan for stale-repo"
+    assert result[0]["target_repo"] == "stale-repo"
+    assert result[0]["labels"] == ["sbom", "stale-repo"]
+    assert result[0]["condition"] == "context.repo.sbom_age_days > 30"