checkpoint: multi-repo Gitea ingestion, per-project repos, rotation anchor_sha fix

Pre-existing uncommitted work found at session start: rotation now emits
anchor_sha on TaskReleased (previously silently dropped by store.Append
validation), multi-repo Gitea provider support, per-project git worktree
roots, and associated test coverage. Committing as a checkpoint before
starting remediation work tracked in AUDIT.md.

internal/router/router_test.go

@@ -2,6 +2,7 @@ package router
 
 import (
 	"encoding/json"
+	"orchestra/internal/authz"
 	"orchestra/internal/domain"
 	"orchestra/internal/registry"
 	"orchestra/internal/store"
@@ -28,7 +29,7 @@ func TestAssignsByAffinityCapabilityAndConcurrency(t *testing.T) {
 	}
 	makeTask := func(id string) {
 		b, _ := json.Marshal(map[string]any{"source": "test", "external_id": id, "project": "p", "capability": []string{"go"}})
-		if err := s.Append(domain.Event{ID: id, TaskID: id, Type: "TaskCreated", Version: 1, Payload: b}); err != nil {
+		if err := s.Append(domain.Event{ID: id, TaskID: id, Type: "TaskCreated", Version: 1, Payload: b, Surface: string(authz.System)}); err != nil {
 			t.Fatal(err)
 		}
 	}
@@ -43,3 +44,45 @@ func TestAssignsByAffinityCapabilityAndConcurrency(t *testing.T) {
 		t.Fatal("no task leased")
 	}
 }
+
+// TestQuotaWindowsAreIndependent proves the 5-hour rolling window and the
+// weekly window (spec §7.2, §9 item 1) are each conservative-80%-full gates
+// on their own — a harness can be fine on one window and excluded by the
+// other, and receipts outside a window must not count toward it.
+func TestQuotaWindowsAreIndependent(t *testing.T) {
+	s, err := store.Open(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now().UTC()
+	report := func(at time.Time, consumed float64) {
+		p, _ := json.Marshal(map[string]any{"harness_id": "h1", "consumed": consumed})
+		if err := s.Append(domain.Event{ID: domain.NewID(), Type: "QuotaReported", TaskID: "quota", Version: 1, Surface: string(authz.System), Payload: p, At: at}); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// Case 1: only weekly limit configured. A receipt older than 5h but
+	// within the week still counts toward the weekly gate.
+	report(now.Add(-6*time.Hour), 85)
+	weeklyOnly := QuotaAvailability{Store: s, Limits: map[string]QuotaWindowLimits{"h1": {Weekly: 100}}, Now: func() time.Time { return now }}
+	if weeklyOnly.Available(registry.Herdr{ID: "h1"}) {
+		t.Fatal("weekly window should be exhausted at 85/100 (>=80%)")
+	}
+
+	// Case 2: only a 5h limit configured. The same 6h-old receipt is outside
+	// the 5h window and must not count.
+	fiveHourOnly := QuotaAvailability{Store: s, Limits: map[string]QuotaWindowLimits{"h1": {FiveHour: 100}}, Now: func() time.Time { return now }}
+	if !fiveHourOnly.Available(registry.Herdr{ID: "h1"}) {
+		t.Fatal("receipt outside the 5h window incorrectly counted against it")
+	}
+
+	// Case 3: a fresh receipt inside the 5h window trips the 5h gate even
+	// though the weekly gate (fed by both receipts) also trips — both are
+	// independently enforced, and either failing excludes the harness.
+	report(now.Add(-time.Minute), 90)
+	both := QuotaAvailability{Store: s, Limits: map[string]QuotaWindowLimits{"h1": {FiveHour: 100, Weekly: 500}}, Now: func() time.Time { return now }}
+	if both.Available(registry.Herdr{ID: "h1"}) {
+		t.Fatal("5h window should be exhausted at 90/100 (>=80%) regardless of weekly headroom")
+	}
+}