Enable daily bounded SBOM catch-up

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

k8s/railiance/20-runtime.yaml

@@ -43,6 +43,50 @@ metadata:
     app.kubernetes.io/name: activity-core
     app.kubernetes.io/part-of: activity-core
 data:
+  daily-sbom-catchup.md: |
+    ---
+    id: daily-sbom-catchup
+    name: Daily SBOM Catch-up
+    enabled: true
+    owner: custodian-agent
+    governance: custodian
+    status: active
+    trigger:
+      type: cron
+      cron_expression: "15 9 * * 1-5"
+      timezone: Europe/Berlin
+      misfire_policy: skip
+    context_sources:
+      - type: sbom-nexus
+        query: catch_up
+        required: true
+        params:
+          limit: 3
+          apply: true
+        bind_to: context.catchup
+    ---
+
+    # Daily SBOM Catch-up
+
+    Ranked, bounded SBOM catch-up. Each fire processes at most three
+    repositories through sbom-nexus and deliberately contains no task rule.
+
+    ```instruction
+    id: daily-sbom-catchup-report
+    trusted_fields: []
+    model: deterministic
+    temperature: 0
+    max_tokens: 1
+    prompt: |
+      Deterministic SBOM catch-up report from context.catchup (no LLM).
+    output_schema: ""
+    review_required: false
+    report_sinks:
+      - type: state-hub-progress
+        event_type: sbom_catchup
+        author: activity-core
+        topic_id: cee7bedf-2b48-46ef-8601-006474f2ad7a
+    ```
   openbao-retention-closeout.md: |
     ---
     id: "e274defb-28f2-571e-abcb-c17b57eab473"