Refactor scoped search to bulk scope actions once virtual scopes land

## Objective

Scoped search for AppConfigFragment, Kernel scheduling history, and Replica Group shipped with temporary, single-target implementations to unblock delivery. Each carries a TODO and must be reworked once virtual scopes and bulk scope actions are available.

## Background

The scope input is already list-shaped and its items are meant to be OR'd, but the underlying actions are single-target BaseScopeActions, so only one scope item is dispatchable today. As a stopgap the adapters reject any request that does not carry exactly one scope item. Separately, a kernel holds no permission records of its own, so a kernel scope item is currently converted to a target on its owning session and narrowed back down with a kernel_id query condition; this should pass a proper kernel-level target once a kernel becomes a scope of its own under virtual scopes.

Currently only the Kernel scheduling history path has landed (see api/adapters/scheduling_history/adapter.py, the scoped_search_\* methods with TODO markers). AppConfigFragment and Replica Group scoped search follow the same pattern and will carry the same TODOs; refactor all three together.

## Depends on

- Virtual scopes (a kernel becomes a scope of its own, holding its own permission records)
- Bulk scope actions (an action that accepts a list of scope items and OR's them)

## Acceptance Criteria

- Scoped search accepts multiple scope items and OR's them, for all three entities (AppConfigFragment, Kernel scheduling history, Replica Group).
- The exactly-one-scope-item rejection is removed from every scoped search adapter.
- The kernel scope item resolves to a kernel-level target directly, without the session-resolution + kernel_id narrowing workaround.
- All related TODO comments are removed.

JIRA Issue: BA-7003

Start in api/adapters/scheduling_history/adapter.py at the scoped_search_* methods and their TODO markers, then locate the corresponding scoped search adapters for AppConfigFragment and Replica Group. Verify how virtual scopes and bulk scope actions represent lists of scope items before changing the adapters. Done means all three accept OR'd multiple scopes, no longer reject non-singleton inputs, resolve kernels directly, and have no related TODOs.

Written by the indexing model from the issue text.