feat(campaign): cross-repo prioritized backlog (v5.7 Fase 2 Block 4b)

buildBacklog(ledger) pure transform + read-only campaign-cli payload field
+ command rendering. The single machine-wide pick-list: per-repo (the ledger
tracks severity counts, not individual findings), severity-weighted
(SEVERITY_WEIGHTS c1000/h100/m10/l1), deterministic tie-break, excludes
implemented/pending/zero-finding repos.

No schema change, no new scanner -> scanner count stays 15, snapshot/backcompat
byte-stable. suite 1138->1150 (lib +9, campaign-cli +3). README badge 1091+->1150+.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -113,7 +113,7 @@ Default: auto-detects scope from git context. Override with `/config-audit full|
 node --test 'tests/**/*.test.mjs'
 ```
 
-1138 tests across 65 test files (21 lib + 34 scanner + 1 hook + 1 agent + 3 commands + 1 knowledge + 4 top-level). Test fixtures in `tests/fixtures/`. Top-level humanizer tests: `json-backcompat.test.mjs`, `raw-backcompat.test.mjs`, `scenario-read-test.test.mjs`, `snapshot-default-output.test.mjs`.
+1150 tests across 65 test files (21 lib + 34 scanner + 1 hook + 1 agent + 3 commands + 1 knowledge + 4 top-level). Test fixtures in `tests/fixtures/`. Top-level humanizer tests: `json-backcompat.test.mjs`, `raw-backcompat.test.mjs`, `scenario-read-test.test.mjs`, `snapshot-default-output.test.mjs`.
 
 ### active-config-reader — load-pattern model + rule/agent/output-style enumeration (v5.6 Foundation)
 
@@ -479,6 +479,34 @@ orchestration is judgment-driven and deliberately outside the snapshot suite, ex
 `/config-audit optimize` + `knowledge-refresh`. **No new agent** (web/judgment-free, runs in the
 command's own context). suite 1127→1138.
 
+### campaign backlog — cross-repo prioritized pick-list (v5.7 Fase 2, Block 4b)
+
+The first half of Block 4 ("one cross-repo prioritized backlog the user picks from"). A pure
+lib transform + a read-only CLI-payload field — **no schema change, no new scanner, byte-stable**.
+
+- **`buildBacklog(ledger)`** (`scanners/lib/campaign-ledger.mjs`, pure, mirrors `rollUp`): the
+  single machine-wide prioritized work list. The actionable unit is a **repo** (the ledger tracks
+  per-repo severity *counts*, not individual findings — it tracks state, it does not re-run
+  audits), so each item is one repo: `{path, name, status, sessionId, findingsBySeverity
+  (normalized), totalFindings, weightedScore, rank}`. **Inclusion:** `status !== 'implemented'`
+  AND `totalFindings > 0` (implemented = done; pending / zero-finding repos have nothing known to
+  fix — they still surface in `rollUp.byStatus`). **Order:** DESC by `weightedScore` (exported
+  `SEVERITY_WEIGHTS = {critical:1000, high:100, medium:10, low:1}`), tie-broken lexicographically
+  by critical→high→medium→low count, then ascending `name` — fully deterministic, and the
+  tie-break keeps "criticals always win" even on a weighted-score collision (1 critical vs 10 high).
+  `rank` is 1-based after the sort.
+- **`campaign-cli`** now emits `backlog: buildBacklog(ledger)` in both branches (uninitialized →
+  `[]`). Purely additive + read-only → fits the Block 3b read-only contract; the existing CLI
+  tests use targeted asserts (not full `deepEqual`), so the new field doesn't break them.
+- **`commands/campaign.md`** renders the backlog as a "Prioritized backlog" pick-list and points
+  the user at the top item (still a pick-list, NOT an executor — execution is the later 4c block).
+
+**Byte-stability.** `-cli`/lib/command only → scanner count stays **15**, snapshot/backcompat
+suite untouched. suite 1138→1150 (lib +9, campaign-cli +3). **Deferred to 4c:** per-repo plan
+export to each repo's `docs/` + reuse of backup/rollback for execution. **Deferred until the first
+breaking schema change:** `migrateLedger` (4a) — backlog needs no schema bump, so building
+migration now would be speculative (`schemaVersion` is already stamped for when it's needed).
+
 ## Gotchas
 
 - Session directories accumulate — use `/config-audit cleanup` to manage