GitHub triggers target any repo

Epic 6368 — Connect Multiple Repositories to Project. Child C7. Original requirement (verbatim): > If the user has, say, twenty repos – one for the backend and another for the UI – they should be able to connect both of them to a project. Implement support for project with multiple repos Settled inputs: PRD (Task 6372), Architecture (Task 6373) — read both; settled. Builds on C1 (`project_repos`, `ProjectOut.repos`). Decision D9 (operator): "Event triggers, Compliance scans, Memory & code map" — GitHub event triggers can target any connected repo. D9 supersedes the automation clause of PRD N10; N10 still governs agent registration `repo_url` and every non-GitHub event source. ## Scope - `EventSourceFields.tsx`: the GitHub trigger's repository field becomes a **Repository** select of the project's connected repos (`owner/name`), defaulting to the primary; blank ("Any repository") still allowed. - `routes/triggers.py`: validate `repository ∈ project repos` (blank = any), refusing otherwise with a field error. - `_default_github_repository` uses the primary `project_repos` row. - Intake/matching unchanged. - No migration in this child (firm constraint — it shares a wave with C3's migration). ## Acceptance criteria (verbatim, Architecture §0) - **AC7.1** — A GitHub event trigger on project P offers a **Repository** select listing every connected repo (B, U), defaulting to the primary. Choosing U saves, and reopening the trigger shows U. The API refuses a `repository` that is not connected to P, with a field error. Blank still means any repository. → verify: dev → Automation → new GitHub trigger on P, pick U, save, reopen. Credentials & reach: - AC7.1 / AC8.1 / AC9.1 | operator login on app.dev.jaah.ai; AC8.1 also needs a node at or above the audit CLI floor (h3 runs 1.2.477, latest) | **verified**: credential fetch + sign-in probe above; node version seen on the Nodes page. - Unit/integration gates | worktree only (`./dc check full`) | needs nothing beyond the worktree Out of scope: No migration. Do NOT change trigger intake/matching or any non-GitHub event source. N10 Do NOT touch agent registration `repo_url` (apps/web/src/pages/agents/*) — `git diff --stat develop... -- apps/web/src/pages/agents/` must be empty. N9 Do NOT add new permissions. Done means: - AC7.1 — verified on dev per the oracle (screenshots of the select listing B and U, and the reopened trigger showing U). - API tests: repository not connected → field error, nothing saved; blank → accepted (any); default = primary. - An existing trigger whose repository equals the primary keeps working unchanged (test). - N10 diff check empty; `./dc check full` green.

GitHub trigger Repository is now a select of the project's connected repos (default primary, Any allowed); API refuses an unconnected repo with a field error. Full gate green; #5499 + #5501 merged, dev deploys OK; dev save/reopen verified. Deferred: two-repo dev check until C2 (6381) ships.