feat(overengineering): roll up out-of-repo findings per owner (#4596)

[kyle-sexton]

Closes #4596

Summary

/overengineering:audit still walks every settings scope. The inline report lists in-repo findings first and in full, then one summary row per out-of-repo owner. Finding ids and artifact rows are unchanged. A custody filter that would skip those layers is declined.

Fix

• Report-template "Custody grouping": in-repo first; out-of-repo collapses to count, verdict mix, and a pointer at the artifact.
• SKILL.md Arguments names the report view and stamps that the walk is unchanged.
• Eval 13 covers the rollup and forbids a custody=repo argument.

Decision

• Claim: the walk still covers every settings scope; only the inline report groups out-of-repo findings per owner. A custody filter is declined because hiding those layers would skip incumbents the skill still has to name.
• Basis: issue overengineering:audit: out-of-repo manifests bury repo findings in a single-repo audit; add a custody filter or a per-owner rollup #4596 after playbooks: repo-sweep overengineering entry walks out-of-repo layers with no default scope #4597 scoped the playbooks repo-sweep entry off the four org-level layers; a direct /overengineering:audit still walks every harness-merged scope.
• As of: 2026-09-28.
• Recheck: when this skill gains a custody-scope argument or stops walking user or machine settings.

Verification

• Eval JSON schema validates; check-evals-quality PASS.
• overengineering 0.4.15 changelog + manifest.

  

[github-actions]

PR body contract — issue linkage

This PR body does not yet satisfy the issue-linkage contract:

• Missing a "## Related" section. List related PRs, ADRs, or decision-log entries this PR does not close.

Edit the body and this comment updates itself on the next run.