feat: Centralize repo selection via core-repos allowlist

[rubambiza]

Summary

Introduce a single source of truth for which repos the programs act on, and wire the programs to it. Today repo selection is split across two mechanisms with no central config: the pr-review scripts hardcode a 4-repo array, while link-health and dep-bump scan whatever happens to be present under the local clone root. Neither excludes archived or non-core repos.

Excluding archived repos alone is insufficient (16 repos are active; only 8 are core), so an explicit allowlist is required.

Work

Allowlist + helpers

• Add config/core-repos.txt: one rossoctl/<name> per line for the 8 curated core repos — rossoctl, automation, agent-skills, .github, cortex, examples, operator, workload-harness. Support # comments and blank lines.
• Add helpers to scripts/program-lib.sh:
  • get_core_repos() — prints owner/name per line; resolves the config path from program-lib's own BASH_SOURCE, honors a $CORE_REPOS_FILE override for tests, and fails loud on a missing/empty file (never silently scans zero repos).
  • canonical_repo_for_dir() — maps a local clone-dir basename to its canonical rossoctl name (encapsulates the remap table kagenti→rossoctl, kagenti-extensions→cortex, identity otherwise) in one place.
• Re-point the "future seam" comment in pr-review-impact.sh to reference the allowlist as the current mechanism; note the org tier Custom Property remains the eventual replacement (not yet viable — property unstamped).

Rewire pr-review scripts

• pr-review-impact.sh get_repos() → delegate to get_core_repos.
• pr-review-scanner.sh REPOS=(...) → populate from get_core_repos; update the help example.

Wire local-clone scanners (allowlist ∩ clones)

• In the link-health and dep-bump scanner/fixer loops, keep iterating clone dirs but skip any dir whose canonical_repo_for_dir is not in the allowlist (loaded once). Build API repo references as rossoctl/<canonical>, not <org>/<basename> — a naive basename would produce wrong names for the two remapped repos.
• Update extract-broken-links.sh to take the canonical full repo name rather than hardcoding a kagenti/ prefix.

Acceptance

• All programs derive their repo set from config/core-repos.txt; the 8 core repos are covered and archived / non-core repos are excluded.
• A unit test exercises get_core_repos against a fixture via $CORE_REPOS_FILE, including the fail-loud-on-empty path.
• Existing tests pass; fixtures updated where the repo-name prefix changed.

[rubambiza]

Part of epic #32.

[rubambiza]

Finding while validating the rename impact: gh pr list --repo <renamed-repo> follows the org rename for a bare listing, but silently drops results when combined with a --label or --author filter. Same repo/query, only the name differs:

• --label ready-for-ai-review on the old name → 0; on the canonical name → 1 (a real labeled PR).
• --author app/dependabot on the old name → 0; on the canonical name → 11 open PRs.

Consequences this masks:

• pr-review-scanner skipped labeled PRs → fixed as an interim hotfix in fix: Point pr-review-scanner at rossoctl repo names #34 (canonical names).
• dep-bump-scanner reports 0 open Dependabot PRs org-wide (false 'all clean') → deferred here, because the proper fix is the shared allowlist enumeration AND it must also resolve duplicate local clones (old + new names for the same repo coexist, which would otherwise double-process).

Takeaway for this issue: the allowlist enumeration must build canonical rossoctl/<name> refs (never rely on redirect for filtered gh pr list queries), and de-duplicate clone dirs that map to the same canonical repo.

[rubambiza]

Field report: link-health scanner "Failed to create issue" — a case for the #29 allowlist wiring

A live link-health run (screenshot to follow) emitted a batch of:

WARN: Failed to create issue for authbridge/demos/**/*.md:https://github.com/rossoctl/rossoctl/blob/main/docs/install.md

Root cause (verified against the deployed scanner): the deployed scanner hardcodes the issue-target repo as "kagenti/" + <clone-dir-basename> (extract-broken-links.sh). The runner has a clone dir named cortex, so it computes kagenti/cortex — a name that never existed and does not redirect (the rename created rossoctl/cortex directly). gh issue create --repo kagenti/cortex → NOT_FOUND → every authbridge/** finding from that clone fails. (The rossoctl/rossoctl/.../install.md in the message is only the broken link inside the file, not the failure cause.)

Two rename-driven aggravators:

• Duplicate clones on the runner (~/kagenti/cortex and ~/kagenti/kagenti-extensions) → same findings attempted twice; the old-name clone succeeds, the new-name clone fails.
• Any clone dir on a post-rename name breaks (kagenti/cortex, kagenti/operator, kagenti/examples, kagenti/rossoctl all NOT_FOUND). Labels / issues-enabled / auth were ruled out — rossoctl/cortex has the labels and issues enabled.

Why this belongs to #29: the fix is to derive the issue-target repo from the canonical repo (skip non-core, dedupe duplicate clones), which is exactly the allowlist wiring #29 introduces. That work is in progress — link-health is being wired to canonical_repo_for_dir() / is_core_repo() and the extractor changed to emit the canonical rossoctl/<name> instead of kagenti/<dir> — but it is not yet in a merged PR. Note the open PR #36 currently wires the pr-review programs to the allowlist and does not include the link-health scripts, so the link-health change still needs to land (fold into #36 or a follow-up under #29) and be deployed before the warnings stop.

Also required (not a code change): the leftover duplicate clone dirs on the runner should be de-duplicated / renamed to canonical names — tracked by #37. The runtime dedupe-by-canonical logic handles the double-scan once deployed, but the stale dirs remain until #37.