fix: match path-qualified catalog entries by repo basename

[saagpatel]

Summary

• match unambiguous path-qualified catalog entries by their repo basename when GitHub metadata lacks a workspace path
• let standalone control-center refreshes repair missing explicit catalog context from the live catalog while preserving already-good audit context
• add regression coverage for path-basename matches and ambiguity avoidance

Verification

• /opt/homebrew/bin/python3.13 -m pytest tests/test_portfolio_catalog.py tests/test_cli_hardening.py tests/test_operator_acknowledgments.py tests/test_weekly_command_center.py -q
• /opt/homebrew/bin/python3.13 -m src.cli security-gate
• /opt/homebrew/bin/python3.13 -m src.cli saagpatel --control-center
• jq confirmed machine-control-tower now matches catalog key _machine/machine-control-tower via path-basename
• jq confirmed ApplyKit has 0 rows in output/operator-control-center-saagpatel-2026-07-04.json after local acknowledgment

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 44de9e980f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Do not basename-match when a workspace path is present

When callers already provide metadata['path'] and that exact path failed to match, this basename fallback can attach a different path-qualified catalog contract to the project. portfolio_truth_reconcile._build_truth_project passes the real relative path into catalog_entry_for_repo (src/portfolio_truth_reconcile.py:433-440), so a project at Other/StatusPage would inherit MoneyPRJsViaGPT/StatusPage if that is the only catalog entry with the same basename, corrupting lifecycle/disposition in the canonical portfolio truth. Please restrict this fallback to truly pathless metadata, or otherwise require the provided path to be compatible before using a basename match.

Useful? React with 👍 / 👎.