fix(ci): migrate github-script to v8 — repair the repo-wide broken gate check

GitHub's runner infra force-upgrades actions/github-script@v7 to Node 24,
where the script-side require('@actions/github') can no longer resolve.
Every recent PR shows a red 'gate' check with 'Cannot find module
@actions/github' regardless of whether it links an issue.

- Pin actions/github-script to ed597411 (v8.0.0) in pr-triage, ci-nudge,
  issue-triage.
- Replace require('@actions/github').getOctokit(APP_TOKEN) with
  new (github.constructor)({ auth: APP_TOKEN }) — v8.0.0 injects no
  getOctokit helper (verified against src/async-function.ts at the pinned
  SHA), and the wrapped require cannot resolve modules without a checkout.
- Bump actions/stale to 1e223db (v10.4.0).

Diagnosis first surfaced by @sandman-sh in #257 — thank you! This lands
separately with a SHA pin and a require-free client construction.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: dukeduke2016

.github/workflows/ci-nudge.yml

@@ -55,7 +55,7 @@ jobs:
           # back to github-actions[bot], defeating this bot's own purpose.
           permission-issues: write
 
-      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           APP_TOKEN: ${{ steps.app-token.outputs.token }}
         with:
@@ -65,7 +65,7 @@ jobs:
             const marker = process.env.MARKER;
 
             const appClient = process.env.APP_TOKEN
-              ? require('@actions/github').getOctokit(process.env.APP_TOKEN)
+              ? new (github.constructor)({ auth: process.env.APP_TOKEN })
               : null;
             async function write(fn) {
               if (appClient) {

.github/workflows/issue-triage.yml

@@ -57,7 +57,7 @@ jobs:
           # of inheriting the App's full installation permissions.
           permission-issues: write
 
-      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           # App token when available (→ testsprite-hob[bot]); else the default
           # GITHUB_TOKEN (→ github-actions[bot]). Either way the logic is identical.

.github/workflows/pr-triage.yml

@@ -71,7 +71,7 @@ jobs:
           # fallback path (unused by this specific App-token mint).
           permission-issues: write
 
-      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           APP_TOKEN: ${{ steps.app-token.outputs.token }}
         with:
@@ -86,7 +86,7 @@ jobs:
             const author = pr.user.login;
 
             const appClient = process.env.APP_TOKEN
-              ? require('@actions/github').getOctokit(process.env.APP_TOKEN)
+              ? new (github.constructor)({ auth: process.env.APP_TOKEN })
               : null;
             // Prefer the App identity; fall back to github-actions[bot] when the
             // App is absent or lacks the Pull-requests permission (403/404).

.github/workflows/stale.yml

@@ -26,7 +26,7 @@ jobs:
       issues: write # comment + (un)label + close stale issues
       pull-requests: write # comment + (un)label + close stale PRs
     steps:
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
         with:
           # ── issues ──────────────────────────────────────────────────────
           days-before-issue-stale: 60