build_scan_plan(target) turns an OnboardedTarget into the ordered set of scans to run, each bound to the artifact it consumes: matrix defaults (applicable_scans) intersected with the target's scan_config enable/disable overrides. Pure and fully unit-tested; the decision engine that run_target will execute next. Refs #133. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>