Add repository grant v2 publish scope and adopt daily security flow

ACTIVITY-WP-0046: grant v2 carries a publish scope (remote, branch, path
prefixes inside allowed_paths, fast-forward only) in its canonical grant id;
v1 stays local-only with unchanged ids.

ACTIVITY-WP-0047: disabled daily-security-flow definition dispatching the
the-custodian runner as an ops_run (CUST-WP-0079-T03).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 296847@bnt-lap001
Assistant-Session: 4f997d46-1b9d-4131-9699-0c353a215155

src/activity_core/glas_evidence.py

@@ -198,6 +198,9 @@ def _normalise_repository_grant_evidence(raw: Any) -> dict[str, Any]:
         "acceptance_policy_id",
         "version",
         "allowed_paths_digest",
+        "remote",
+        "branch",
+        "pushed_head",
     ):
         value = raw.get(key)
         if isinstance(value, str):
@@ -206,9 +209,10 @@ def _normalise_repository_grant_evidence(raw: Any) -> dict[str, Any]:
         value = raw.get(key)
         if isinstance(value, int) and not isinstance(value, bool) and value >= 0:
             result[key] = min(value, 1_000_000)
-    publish = raw.get("publish")
-    if isinstance(publish, bool):
-        result["publish"] = publish
+    for key in ("publish", "fast_forward_only", "published"):
+        value = raw.get(key)
+        if isinstance(value, bool):
+            result[key] = value
     return result