Move the Dependabot alert sweep from the nonexistent PROJECT_TOKEN to the GitHub App token #2547

Problem

.github/workflows/dependabot-alerts.yml (line 103) passes secrets.PROJECT_TOKEN to the sweep, so that it can place each filed issue on board #28 at Todo / High. That secret has never existed, so every run degrades to filing a labeled, milestoned issue that waits for manual /issue-triage.

Change

Once the GitHub App exists (#2544), switch the workflow to it:

• Add an actions/create-github-app-token step, SHA-pinned (verify:action-pins, SHA-pin the GitHub Actions that hold secrets or publish (claude-code-action, release job) #2484), that mints an installation token from the App id and private key secrets.
• Pass that token to the sweep in place of PROJECT_TOKEN, and delete the PROJECT_TOKEN path and its references in the workflow comments and AGENTS.md.
• Keep the degrade-to-triage fallback, so a run with the secret missing (a fork, for example) still files issues and stays green.
• Consider moving the alert read to the App as well (Dependabot alerts: read) so the sweep runs under one identity. The workflow's vulnerability-alerts: read already works, so this is optional.

Acceptance

• A scheduled or dispatched run files a test alert's issue and boards it at Todo / High on Add tab and approval flow for server -> client sampling #28
• With the App secrets absent, the run still files the issue and logs the triage hand-off
• verify:action-pins passes, and no PROJECT_TOKEN reference remains

Blocked on

#2544 (the GitHub App). Part of tracker #2543.