fix(index): include unscanned repository targets

[sylvesterkaczmarek]

Summary

Include persisted security targets that have not been scanned yet in the native repository index, and make the not_scanned status filter functional.

Fixes #546.

Reproduction / evidence

Current upstream main at 37bf87a692fc72d41f7312cc48808d699d204fba can persist a target before any scan exists: create_workspace() calls ensure_security_target() when a target path is selected.

list_repositories() currently builds its repository collection only from latest_scan_by_target.items(). Every row admitted to the collection therefore already has a scan. The later predicate args.status != "not_scanned" then rejects every row when not_scanned is requested.

A deterministic state with two persisted targets and a scan for only one target produces an empty not_scanned result on current main.

Root cause

Scan history, rather than security_targets, was used as the primary set for the repository index. Zero-scan targets were discarded before status filtering.

Fix

• retain the existing latest-scan ordering for scanned targets;
• append persisted targets that have no scan history;
• use scanCount: 0 and latestScan: null for unscanned targets;
• apply explicit scanned and not_scanned predicates from scanCount;
• preserve the existing open_findings behavior.

Tests / validation

Added native-repository-index.test.ts. It imports the actual Python index module against an in-memory SQLite fixture containing one scanned and one unscanned target, then verifies:

• the unfiltered repository index includes both targets;
• status=scanned returns only the scanned target;
• status=not_scanned returns only the zero-scan target;
• the unscanned row has scanCount: 0 and latestScan: null.

The branch is based directly on current upstream main at 37bf87a692fc72d41f7312cc48808d699d204fba and is not behind it. Production change: 12 additions and 5 deletions.

Full repository tests cannot be run in this execution environment because the repository cannot be cloned here. Pushed-head CI remains the authoritative full-suite validation.

Risk

Low. Existing scanned repository ordering and summaries are preserved. The only newly surfaced rows are persisted targets with zero scans, which the existing status vocabulary already models.