fix(docs): add GitHubTokenSecret to SecretsManager resource scope

CDK generates the GitHub token secret with construct ID hash
(GitHubTokenSecret09BC4210-*), not the backgroundagent- prefix.
Add this pattern to the SecretsManager statement Resource list.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: scottschreckengaust

docs/design/DEPLOYMENT_ROLES.md

@@ -415,7 +415,10 @@ DynamoDB tables, Lambda functions, API Gateway, Cognito, WAFv2, EventBridge, and
         "secretsmanager:PutResourcePolicy",
         "secretsmanager:DeleteResourcePolicy"
       ],
-      "Resource": "arn:aws:secretsmanager:*:*:secret:backgroundagent-*"
+      "Resource": [
+        "arn:aws:secretsmanager:*:*:secret:backgroundagent-*",
+        "arn:aws:secretsmanager:*:*:secret:GitHubTokenSecret*"
+      ]
     },
     {
       "Sid": "SecretsManagerAccountLevel",

docs/src/content/docs/architecture/Deployment-roles.md

@@ -419,7 +419,10 @@ DynamoDB tables, Lambda functions, API Gateway, Cognito, WAFv2, EventBridge, and
         "secretsmanager:PutResourcePolicy",
         "secretsmanager:DeleteResourcePolicy"
       ],
-      "Resource": "arn:aws:secretsmanager:*:*:secret:backgroundagent-*"
+      "Resource": [
+        "arn:aws:secretsmanager:*:*:secret:backgroundagent-*",
+        "arn:aws:secretsmanager:*:*:secret:GitHubTokenSecret*"
+      ]
     },
     {
       "Sid": "SecretsManagerAccountLevel",