fix: keep portfolio registry notes idempotent

[saagpatel]

Summary

• Strip generated purpose prefixes from legacy registry notes during portfolio truth reconciliation
• Add a regression test for repeated generated purpose text in registry notes
• Regenerated live portfolio truth locally and confirmed the GithubRepoAuditor notes field no longer accumulates repeated prose

Verification

• /opt/homebrew/bin/python3.13 -m pytest tests/test_portfolio_truth.py -q
• /opt/homebrew/bin/python3.13 -m src.cli security-gate --output-dir output --max-age-hours 168 --json

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7de15cf8ff

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve manual notes that start with the purpose

Because this normalization now runs for every legacy_registry_path, not just registries known to be generated by portfolio_truth_render, a hand-maintained legacy row whose Notes text legitimately begins with the repo/group purpose gets rewritten in the canonical snapshot. For example, with purpose API migration and notes API migration blocked on auth, the loop removes the leading phrase and stores only blocked on auth in declared.notes; scope the stripping to generated registry input or another unambiguous generated prefix so legacy source text is not silently lost.

Useful? React with 👍 / 👎.