Compliance scans cover every repo

Epic 6368 — Connect Multiple Repositories to Project. Child C8. Original requirement (verbatim): > If the user has, say, twenty repos – one for the backend and another for the UI – they should be able to connect both of them to a project. Implement support for project with multiple repos Settled inputs: PRD (Task 6372), Architecture (Task 6373) — read both; settled. Builds on C1 (`project_repos`) and C3 (each non-primary repo checked out at `_repos/<rid>/<N>` in the slot, S3a manifest). Decision D9 (operator): compliance scans cover every repo of a project. ## Scope - `governance/scans.py`: a project is `unscannable` when it has no `project_repos` rows. - `serve_spec` serves `repos[]` (id, repo_url, path in the slot). - The auditor persona runs `jaah-audit prepare/submit` once per repo path in its slot; `compliance.submit` carries `repo_url`. - `facts.repo_entity` keyed per repo (already `repo:<url>`). - Per-repo results: today `gov_scan_targets` is unique per (scan, project) and the ledger is one row per scan target; extend keying additively so each repo gets its own result and scanned sha (this child may carry one expand-only migration; C9 waits on this child so the wave holds one migration at a time). - `/compliance/repos/:projectId` shows one section per repo with a `?repo=<id>` filter. ## Acceptance criteria (verbatim, Architecture §0) - **AC8.1** — A compliance scan of P covers every repo. `/compliance/repos/<P id>` shows one section per repo (B, U), each with its own results and scanned sha. → verify: dev → Compliance → P → Run scan; after it completes, observe both sections. - **AC2.3 (compliance page)** — the compliance page for a migrated single-repo project renders as before. Credentials & reach: - AC7.1 / AC8.1 / AC9.1 | operator login on app.dev.jaah.ai; AC8.1 also needs a node at or above the audit CLI floor (h3 runs 1.2.477, latest) | **verified**: credential fetch + sign-in probe above; node version seen on the Nodes page. - Unit/integration gates | worktree only (`./dc check full`) | needs nothing beyond the worktree Out of scope: Do NOT change pack authoring, guard runtime or remediation flows. Do NOT make the ledger mutable (it is immutable by trigger). N1 Do NOT make gate, stack, merge lane, GHA runners or CI OIDC per repo. N9 Do NOT add new permissions. Done means: - AC8.1 verified on dev per the oracle (screenshot of both sections, each with its own sha). - Tests: a project with zero repo rows is `unscannable`; a two-repo project yields one result per repo; one repo's failed prepare does not hide the other repo's section (it shows its own error). - Migration expand-only, re-runnable; an old-release statement still works (no key it relies on removed). - A single-repo project's compliance page renders as before (test + dev screenshot). - `./dc check full` green.

Compliance scans now cover every repo: one target and ledger row per repo, repos[] spec, per-repo jaah-audit, a section per repo with a ?repo= filter, expand-only migration. #5512 + follow-up #5522 merged, full gate green, dev deploys OK. AC8.1 verified on dev: both repos shown, each with its own sha. AC2.3 covered by tests; on dev the single-repo page has its old layout, but its own scan was still queued, so no results shown. Deferred: scope preview and facts read only the primary repo.