feat(sbom): draft bounded daily SBOM catch-up (ACTIVITY-WP-0030-T01)

Add the sbom-nexus catch_up resolver contract and the daily replacement for
weekly-sbom-staleness, both disabled until CUST-WP-0062-T03 lands.

The weekly check used `for_each: context.repos.repos` and emitted one task per
stale repo — 75 tasks on 2026-08-17 against 111/111 stale repos. The
replacement asks sbom-nexus for only the N oldest-stale repos in one ranked
call and carries no rule block at all, so tasks_spawned is 0 by construction.

- context_resolvers/sbom_nexus.py: source type `sbom-nexus`, query `catch_up`,
  GET /sbom/catch-up?limit=N. Read-only; ingest is T02. Limit bounded 1..25 and
  the response truncated to it so an over-long reply cannot widen T02's
  side-effect.
- activity-definitions/daily-sbom-catchup.md: weekdays 09:15 Berlin, enabled:
  false, deterministic sbom_catchup progress sink.
- rules/executor.py: the deterministic report builder only special-cased
  context.repos, which would have emitted a contentless progress event for this
  definition. _sbom_catchup_report names the selected repos and reads
  updated/skipped from context when T02 populates them.
- 17 tests against a test double; no live nexus exists yet.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/ACTIVITY-WP-0030-daily-sbom-catchup.md

@@ -8,7 +8,7 @@ status: active
 owner: grok
 topic_slug: infotech
 created: "2026-08-18"
-updated: "2026-08-20"
+updated: "2026-08-21"
 parent_workplan: CUST-WP-0062
 related:
   - CUST-WP-0062
@@ -53,7 +53,7 @@ each. The replacement must ask sbom-nexus for **only N targets** and then
 
 ```task
 id: ACTIVITY-WP-0030-T01
-status: wait
+status: done
 priority: high
 state_hub_task_id: "b216976e-5402-4e40-b282-78c5d021df72"
 ```
@@ -72,6 +72,26 @@ lands):
 - each repo: `repo_slug`, `last_sbom_at`, `sbom_age_days`, `has_sbom`,
   `checkout_available` if known
 
+Done 2026-08-21 against a test double — CUST-WP-0062-T03 has not landed, so
+there is no live nexus yet and the definition stays `enabled: false`:
+
+- `activity-definitions/daily-sbom-catchup.md` — weekdays 09:15 Berlin, one
+  `sbom-nexus / catch_up` source bound to `context.catchup`, **no rule block**
+  (`tasks_spawned` stays 0 by construction), deterministic `sbom_catchup`
+  progress sink.
+- `src/activity_core/context_resolvers/sbom_nexus.py` — source type
+  `sbom-nexus`, query `catch_up`, `GET /sbom/catch-up?limit=N` against
+  `SBOM_NEXUS_URL`. Read-only; ingest is T02. Limit is bounded 1..25 and the
+  response is truncated to it so an over-long reply cannot widen T02's
+  side-effect.
+- `_sbom_catchup_report` in `rules/executor.py` — the existing deterministic
+  builder only special-cased `context.repos`, which would have emitted a
+  contentless progress event. The new branch names selected repos and reads
+  `updated` / `skipped` from context when T02 populates them.
+- `tests/test_sbom_nexus_context_resolver.py` — 17 tests: contract shape,
+  default N=3, bounding, truncation, partial-entry normalisation, malformed
+  responses, progress content, and definition boundedness.
+
 ### Implement ingest side-effect for N targets
 
 ```task