Multi-repo pipelines: coordinated PRs across repositories (#3393)

[james-in-a-box]

Lets a single pipeline operate across an arbitrary number of repositories and open coordinated, cross-referencing PRs — one per slice, each in that slice's repo — with cross-repo ordering expressed through the existing slice-dependency mechanism. Replaces the manual hand-off that today carves the cross-repo half of a logically-single change out of the pipeline and gives it to an engineer.

The change is built on the ratified refine analysis's verified thesis: the single-repo assumption is concentrated, not pervasive. The gateway worktree list, per-repo credentials, create_slice_pr(repo=...), and repo-agnostic push policy already exist; the concentrated gaps are the contract's missing repo dimension and the repos[0] collapse in the agent environment.

Delivered as a single serialized six-slice chain (five slices edit orchestrator/routes/pipelines.py, so per #3046 they are ordered along one dependency chain):

1. Repo dimension across the two model layers: contract-layer Slice.repo + a pure additive schemaVersion 1.3→1.4 stamp (Slice.repo stays None on legacy load), and orchestrator-layer Pipeline.repos (RepoSpec) + primary_repo + a runtime resolve_slice_repo where absent⇒primary is resolved; N=1 round-trips/behaves unchanged.
2. List-shaped submission (submit_task / POST /api/v1/pipelines accept a list of {repo, base_branch}) with submission-time validation rejecting mixed-visibility and mixed-auth-mode sets.
3. Removal of all three enumerated repos[0] collapse sites plus a full repo→worktree map exposed to the agent environment re-keyed by full owner/repo (operator ruling Phase 4: CLI implementation #6), guarded by a ratchet test + grep sweep.
4. Slice-PR routing to slice.repo and a lazy-per-repo work branch + context PR (every repo with ≥1 slice; PRs cross-reference siblings).
5. Cross-repo merge-sequencing hold (cq-1 two-tier) with pinned failure semantics: automated draft→ready on the upstream PR's merged boolean/mergedAt (not head-SHA) via a new mark_pr_ready gateway verb; closed-unmerged and never-merging (bounded poll) both escalate to a HITL hold; a separate HITL hold type for beyond-merge-state conditions (release/publish, version pin, genuine development block). Dependencies gate merge-readiness, not development.
6. Per-repo test-gate + reviewer-diff scoping and per-repo conventions (each slice's gates run in that slice's repo worktree under that repo's CLAUDE.md / linters / check commands).

Out of v1 (deferred): mixed auth modes across repos, richer merge-sequencing machinery, and cross-repo atomic merge (impossible on GitHub — v1 ships an ordering hold, not atomicity).

Test Plan

Automated (per slice; make test narrows to reachable suites, then make test-all before phase exit; make lint green throughout):

• Slice 1: shared/egg_contracts/tests — schemaVersion 1.3→1.4 migration; absent Slice.repo ⇒ primary repo; legacy singleton Pipeline.repo ⇒ one-element list; JSON round-trip; N=1 back-compat unchanged.
• Slice 2: orchestrator/tests — list submission accepted; bare single repo still accepted; mixed-visibility set rejected with actionable error; mixed-auth-mode set rejected; primary-repo defaulting.
• Slice 3: orchestrator/tests — agent env exposes the full repo→path map keyed by owner/repo; all three collapse sites gone; a ratchet test asserts no repos[0] collapse reintroduced (with the len(repos)==1-guarded sdlc_hitl.py:82 explicitly allowed).
• Slice 4: orchestrator/tests — slice PR created in slice.repo; a repo with ≥1 slice gets a work branch + context PR, a slice-less submitted repo gets neither; sibling-PR cross-reference rendered.
• Slice 5: orchestrator/tests — dependent slice PR opens draft; upstream-merge poll auto-marks it ready; beyond-merge-state condition routes to a HITL hold, not auto-release; development is not serialized by the dependency.
• Slice 6: orchestrator/tests — test gate and reviewer diff scope to the slice's repo worktree only; per-repo check commands resolved from the slice's repo.

Regression baseline: single-repo (N=1) pipelines exhibit no behavior change; existing suites stay green.

Manual Steps

Pre-merge: none.

Post-merge: the schema migration (schemaVersion 1.3→1.4) applies lazily on contract load following the four existing precedents — no manual migration of persisted contracts is required; absent Slice.repo resolves to the pipeline's primary repo on read. New multi-repo behavior takes effect for pipelines submitted after the orchestrator image is rebuilt/redeployed on the normal release cadence. File a follow-up issue for the deferred scope: mixed auth modes across repos and any richer first-class merge-sequencing machinery beyond the v1 hold.

Pipeline context

• Pipeline: issue-3393
• Issue: Feature: multi-repo pipelines — coordinated PRs across repositories in one pipeline #3393
• Slices (7):
  1. Repo dimension in the persisted contract & pipeline schema (migration) (slice-1) — [issue-3393][slice-1/6] Repo dimension in the persisted contract... #3422
  2. List-shaped submission + uniform visibility/auth validation (slice-2) — [issue-3393][slice-2/6] List-shaped submission + uniform... #3423
  3. Stop the repos[0] collapse; owner/repo-keyed worktree map in agent env (slice-3) — [issue-3393][slice-3/6] Stop the repos[0] collapse... #3424
  4. Slice-PR routing to slice.repo + lazy per-repo work branch & context PR (slice-4) — [issue-3393][slice-4/6] Slice-PR routing to slice.repo + lazy... #3429
  5. Cross-repo merge-sequencing hold (cq-1 two-tier) (slice-5) — [issue-3393][slice-5/7] Cross-repo merge-sequencing hold (cq-1... #3430
  6. Per-repo test-gate + reviewer-diff scoping + per-repo conventions (slice-6) — [issue-3393][slice-6/7] Per-repo test-gate + reviewer-diff scoping... #3437
  7. Secondary-repo worktree + branch materialization (cq-4) (slice-7) — [issue-3393][slice-7/7] Secondary-repo worktree + branch... #3442
• Docs: Refine analysis, Refine analysis (human summary), Implementation plan, Implementation plan (human summary)

Per-phase BRC transcripts: refine, plan, implement-unattributed.