Expand rule actions for per-repo tasks

Add safe action interpolation and for_each binding for rule fan-out, update the weekly SBOM definition, cover the new evaluation path, and reconcile activity-core scope/workplans for the State Hub sync.

workplans/ADHOC-2026-06-01.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Ad hoc — activity-core opportunistic fixes 2026-06-01"
 domain: custodian
 repo: activity-core
-status: ready
+status: finished
 owner: custodian
 topic_slug: custodian
 created: "2026-06-01"
-updated: "2026-06-01"
+updated: "2026-06-03"
 state_hub_workstream_id: "36162ff0-9b47-47c4-8602-56767f9b7a1c"
 ---
 
@@ -112,7 +112,7 @@ worst-repo fields to the top of `context.repos`).
 
 ```task
 id: ADHOC-2026-06-01-T02
-status: todo
+status: done
 priority: low
 state_hub_task_id: "6b3a185e-cbea-454c-82fb-8b4c16cefef0"
 ```
@@ -168,6 +168,32 @@ expressions and a stale-repo workflow run emits a TaskSpec with the actual
 repo slug, or (b) a recorded decision explicitly defers/declines the change
 with reasoning.
 
+**Completion — 2026-06-03:**
+
+Implemented explicit rule action expansion in `activity_core.rules.actions`.
+`evaluate_rules` now returns concrete TaskSpec dictionaries directly, and
+`RunActivityWorkflow` no longer lifts raw YAML action fields itself.
+
+Action fields support two safe interpolation forms:
+- whole-field paths such as `target_repo: context.repo.repo_slug`
+- scalar placeholders such as `task_template: Run SBOM rescan for {context.repo.repo_slug}`
+
+Rules may opt into per-item binding with:
+
+```yaml
+for_each: context.repos.repos
+bind_as: repo
+condition: 'context.repo.sbom_age_days > 30'
+```
+
+`activity-definitions/weekly-sbom-staleness.md` now uses that explicit
+contract, so bulk SBOM staleness evaluation emits one task per stale repo
+instead of one task for the hoisted worst repo. Tests cover direct action
+interpolation, `for_each` binding, activity-level rule evaluation, and the
+weekly SBOM integration path.
+
+Tests: `PYTHONPATH=src .venv/bin/python -m pytest -q` -> 125 passed, 1 skipped.
+
 ### T03 - Make activity-core's Temporal activity timeout env-configurable
 
 ```task