feat(activity): repo-scoped automation review CLI (WP-0028)

Ship the activity console script for consumer-repo morning review: list,
status, runs, deliverables, inbox, checkpoint, and ack. Offline-first with
git + local defs; enriches from ops API and State Hub. Multi-source trust
matrix never reports did-not-run when git has the artefact. Adds
target_repo filter on GET /ops/automations.

src/activity_core/ops_api.py

@@ -75,13 +75,38 @@ class MutateBody(BaseModel):
 @router.get("/automations")
 async def list_automations(
     enabled: str = Query(default="all"),
+    target_repo: str | None = Query(
+        default=None,
+        description="Filter automations whose name/id/labels mention this repo slug (ACTIVITY-WP-0028)",
+    ),
 ) -> dict[str, Any]:
-    return await ops_inventory(
+    report = await ops_inventory(
         db_url=_db_url(),
         temporal_host=os.environ.get("TEMPORAL_HOST"),
         temporal_namespace=os.environ.get("TEMPORAL_NAMESPACE", "default"),
         enabled=enabled,
     )
+    if target_repo and isinstance(report, dict):
+        needle = target_repo.strip().lower()
+        autos = report.get("automations") or []
+        if isinstance(autos, list) and needle:
+            filtered = []
+            for a in autos:
+                if not isinstance(a, dict):
+                    continue
+                blob = " ".join(
+                    str(a.get(k) or "")
+                    for k in ("name", "id", "activity_id", "slug", "labels")
+                ).lower()
+                if needle in blob:
+                    filtered.append(a)
+            report = dict(report)
+            report["automations"] = filtered
+            report["filters"] = {
+                **(report.get("filters") or {}),
+                "target_repo": target_repo,
+            }
+    return report
 
 
 @router.get("/automations/status")