fix(onboarding): targets visibility + unified pipeline by default (#154)

compliance-agent/src/agent.rs

@@ -70,6 +70,26 @@ impl ComplianceAgent {
         }
     }
 
+    /// Run a scan for an onboarded target through the unified pipeline,
+    /// unconditionally.
+    ///
+    /// Unlike [`Self::run_scan`], this does *not* consult the
+    /// `unified_pipeline` transition flag: the caller (the `/targets/{id}/scan`
+    /// endpoint) operates on `onboarded_targets` by construction, so it must
+    /// always dispatch to `run_target` regardless of how the legacy paths
+    /// (scheduler, webhooks, `/repositories/{id}/scan`) are configured.
+    pub async fn run_target_scan(
+        &self,
+        tenant_id: &str,
+        target_id: &str,
+        trigger: compliance_core::models::ScanTrigger,
+    ) -> Result<(), crate::error::AgentError> {
+        let db = self.db_pool.for_tenant_id(tenant_id).await?;
+        let orchestrator =
+            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
+        orchestrator.run_target(target_id, trigger).await
+    }
+
     /// Run a PR review: scan the diff and post review comments.
     pub async fn run_pr_review(
         &self,