[quality] test: cover rescanRepos success/fail-closed/work-source overlay arms (cmd/hive/repos_rescan.go)

[kubestellar-hive]

Test Improvement

rescanRepos (cmd/hive/repos_rescan.go) — the read-only half of the eval cycle behind the dashboard Rescan button — was at 7.4% statement coverage: only the nil-client (errNoForgeCredentials) arm was tested.

This PR adds src/cmd/hive/repos_rescan_paths_test.go covering the remaining arms:

• Success path — enumeration returned, published to the shared lastActionable pointer, dashboard refresh invoked
• Nil refresh hook tolerated on success
• All-repos GitHub failure on the default work source fails closed — error returned, previously published snapshot kept, no repaint (a zero-count repaint would read as "repos went quiet", not "GitHub is down")
• GitHub outage on a non-GitHub work source keeps the scan alive via actionableAfterGitHubEnumerate, with the overlay's fail-closed (config error → zero issues) arm exercised and log assertions
• Overlay replaces only the issue side — GitHub PRs kept for PR maintenance

rescanRepos: 7.4% → 100%. Fixtures use github.NewClientForTest against a local httptest server (same pattern as automerge_sweep_wiring_test.go); no network, no /data writes.

Claimed ground

Files: src/cmd/hive/repos_rescan_paths_test.go (new, test-only). Functions under test: rescanRepos. Disjoint from open quality PRs #6120 (dashboard rescan route auth test), #6136/#6159/#6127 (other cmd/hive helpers), and all other open hold-gated PRs.

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.