fix(scope): default DAG visibility to the project's visibility for project scopes

[christophergeyer]

The bug

When a repo is scoped to an org project (roar scope use <org>/<project>), roar always defaulted the registered DAG's visibility to private — even when the project itself is public. To get a public DAG under a public project, users had to pass --public, but --public bypasses the project scope entirely and loses org attribution (owner_id/project_id). So there was no way to register a public, org-attributed DAG for a public project.

Two spots hardcoded project → private and never consulted the project's actual visibility:

• roar/publish_auth.py _scope_visibility(...)
• roar/cli/publish_intent.py resolve_publish_intent(...)

The project's visibility is available from the GLaaS access-context (projects_by_owner[].visibility, already shown by roar scope list), but roar scope use never captured it and RepoScope had no visibility field.

The fix (narrow, backward-compatible)

A DAG registered under a project scope now defaults to the project's own visibility:

• roar/scope_config.py: added optional RepoScope.visibility; read from the [treqs] binding.
• roar scope use: resolves the project's visibility from the same access-context source roar scope list uses and persists visibility = "..." into the [treqs] binding.
• _scope_visibility: a project scope returns "public" only when the bound project is public; otherwise still "private".
• resolve_publish_intent: a project scope defaults public only when scope.visibility == "public".

Only public projects change behavior. A public project now yields a public, org-attributed DAG (owner_id/project_id preserved in scope_request).

Unchanged

• Explicit --public / --private / --anonymous still win (a --private on a public project still registers private).
• Private/unknown-visibility projects still default to private.
• Non-project scopes (public/private/anonymous/unset) are untouched.
• A legacy [treqs] binding without visibility behaves exactly as before (private default).

Tests

Added/extended unit tests in tests/unit/:

• test_scope_config.py: load_repo_scope reads visibility; defaults None when absent; roar scope use persists public/private project visibility.
• test_publish_intent.py: project scope public → public intent; private/unset → private; explicit --private overrides a public project.
• test_publish_auth_context.py: public project → scope_request.visibility == "public" with owner_id/project_id preserved.

All tests/unit (1145 tests) pass.

🤖 Generated with Claude Code