feat(campaign): cross-repo prioritized backlog (v5.7 Fase 2 Block 4b)

buildBacklog(ledger) pure transform + read-only campaign-cli payload field
+ command rendering. The single machine-wide pick-list: per-repo (the ledger
tracks severity counts, not individual findings), severity-weighted
(SEVERITY_WEIGHTS c1000/h100/m10/l1), deterministic tie-break, excludes
implemented/pending/zero-finding repos.

No schema change, no new scanner -> scanner count stays 15, snapshot/backcompat
byte-stable. suite 1138->1150 (lib +9, campaign-cli +3). README badge 1091+->1150+.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scanners/campaign-cli.mjs

@@ -28,6 +28,7 @@ import {
   loadLedger,
   validateLedger,
   rollUp,
+  buildBacklog,
   defaultLedgerPath,
 } from './lib/campaign-ledger.mjs';
 
@@ -72,6 +73,7 @@ async function main() {
       updatedDate: null,
       repos: [],
       rollUp: rollUp({ repos: [] }),
+      backlog: buildBacklog({ repos: [] }),
     };
     exitCode = 1; // advisory: there is no campaign to report yet
   } else {
@@ -88,6 +90,7 @@ async function main() {
       updatedDate: ledger.updatedDate,
       repos: ledger.repos,
       rollUp: rollUp(ledger),
+      backlog: buildBacklog(ledger),
     };
     exitCode = 0;
   }