Cleanup policies, fix `.requiring_cleanup` scope

Summary

Small container repositories will get cleaned up many times during a single policy execution due to this scope. What happens is that the repository will do ongoing -> unscheduled -> ongoing -> unscheduled -> ... until the policy's next_run_at is scheduled to a future time.

Solution

Update the scope so that repositories are only cleaned once per policy executions.