feat(dashboard): nav restructure, full context-help coverage, 11 new ref docs

Navigation:
- New order: Overview · Todo · Domains · Repos · Workstreams (collapsible,
  open:false, with atomic sub-entries: Decisions, Tasks, Debt, Extends,
  Dependencies) · Contributions · SBOM · Progress · Reference (collapsible)
- Reference section gains path:/reference landing page; all 18 doc pages
  listed in nav (alphabetical) and in reference.md table

New pages:
- todo.md — Internal / Ecosystem / Third-party todo classification
- dependencies.md — dependency edge table derived from state/summary
- reference.md — Reference landing page with full doc index

New reference doc pages (11):
  contributions, debt, dependencies, domains, extensions, overview,
  repos, tasks, todo + reference (meta) already added previously

doc-overlay.js — lazy bubblehelp tooltip:
- _titleCache Map + _fetchDocTitle(docPath): on first hover of any ?
  button, fetches the target doc page, parses <h1>, sets btn.title
- Native browser tooltip appears exactly on the ? circle on subsequent hover

Context-help wired on all 14 dashboard pages:
- h1 withDocHelp added to: index, todo, domains, repos, tasks, techdept,
  extensions, dependencies (contributions/workstreams/decisions/sbom/
  progress/reference were already wired)
- domains.md + repos.md: added missing withDocHelp import and live-data link
- tasks/techdept/extensions: removed duplicate _h1 const that caused
  SyntaxError: Identifier '_h1' has already been declared

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dashboard/src/docs/repos.md

@@ -0,0 +1,83 @@
+---
+title: Repos — Reference
+---
+
+# Repos — Reference
+
+The Repos page shows every repository registered in the Custodian ecosystem,
+their SBOM ingestion status, and a domain-grouped coverage map.
+
+---
+
+## What is a managed repo?
+
+A managed repo is a git repository that has been registered with the state hub
+via `make add-repo` or `register_repo()`. Registration records the repo's slug,
+domain, local path, and optional remote URL. Once registered, the repo can
+receive SBOM ingestion and is eligible for the ADR-001 workplan validator.
+
+---
+
+## KPI row
+
+| Card | Meaning |
+|------|---------|
+| **Registered Repos** | Active repos only (status = active) |
+| **Domains** | Count of distinct domain slugs across registered repos |
+| **SBOM Ingested** | Repos with at least one SBOM snapshot |
+| **SBOM Gaps** | Repos with no ingested SBOM — red border when > 0 |
+
+---
+
+## Coverage Map
+
+Groups repos by domain. Each domain block shows:
+
+- **Domain name** with SBOM, EP, and TD chip indicators
+- **SBOM chip** — green ✓ if all repos in the domain are ingested, amber ⚠ if any gap exists
+- **EPs chip** — count of open/in-progress extension points for this domain
+- **TDs chip** — count of open/in-progress technical debt items for this domain
+- **Repo table** — one row per repo with SBOM status, package count, and local path
+
+Rows with no SBOM are highlighted in amber.
+
+---
+
+## Filters
+
+| Filter | Effect |
+|--------|--------|
+| **Domain** | Show repos for a single domain only |
+| **Gaps only** | Toggle to show only repos without an ingested SBOM |
+
+---
+
+## Ingesting a repo's SBOM
+
+```bash
+# Register a new repo
+cd ~/the-custodian/state-hub
+make add-repo DOMAIN=<slug> SLUG=<repo-slug> NAME="Display Name" PATH=/absolute/path
+
+# Ingest SBOM (auto-detects lockfile at repo root)
+make ingest-sbom REPO=<slug> REPO_PATH=/absolute/path
+
+# Multi-ecosystem repo — scan all lockfiles recursively
+make ingest-sbom REPO=<slug> SCAN=1 REPO_PATH=/absolute/path
+```
+
+Supported lockfile formats: `uv.lock`, `requirements.txt`, `package-lock.json`,
+`yarn.lock`, `Cargo.lock`, `.terraform.lock.hcl`.
+
+---
+
+## Infra-only repos
+
+Repos with no lockfile (Ansible, shell scripts) can be registered for inventory
+purposes. The SBOM gap is expected and can be left as-is. Terraform providers
+are auto-detected via `.terraform.lock.hcl` when using `--scan`.
+
+---
+
+*SBOM snapshots are replaced on each ingest — not appended. The last ingestion
+timestamp is recorded on the managed_repo row.*