fix(ci): correct 3 secret-name mismatches causing silent no-ops (#352)

## Summary
Post-breach credential audit found two workflows referencing secret
names that don't exist on this repo, causing silent degradation instead
of loud failure:

1. `supervised-fleet-scan.yml` — referenced `secrets.FLEET_SCAN_PAT`
(never configured). Only `HYPATIA_SCAN_PAT` exists, and its scope
matches exactly what this step's own comment says it needs (Contents +
Dependabot alerts read, for cross-repo CVE scanning). Pointed at the
secret that actually exists.
2. `inbox-steward.yml` "Validate PRs" — referenced `secrets.FARM_PAT`
(never configured). This step only reads check-runs/reviews/PRs on `${{
github.repository }}` itself — never needed a cross-repo PAT. Switched
to `secrets.GITHUB_TOKEN`.
3. `inbox-steward.yml` "Send dispatch to Hypatia" — same missing
`FARM_PAT`, but this step genuinely dispatches cross-repo, so kept the
PAT-with-fallback shape, just pointed at `FARM_DISPATCH_TOKEN` (the
secret that's actually meant to carry that capability — currently dead
pending a separate redistribution effort, tracked elsewhere; the `||
secrets.GITHUB_TOKEN` fallback means this degrades safely either way).

No behavior regression possible — all three references were 100%
guaranteed-broken before this change (referencing secrets that don't
exist), so this is strictly an improvement.

## Note
Unrelated to this PR: `git push` surfaced "GitHub found 4
vulnerabilities on this repo's default branch (1 high, 1 moderate, 2
low)" via Dependabot — flagging for separate follow-up, not touched
here.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/inbox-steward.yml

@@ -166,7 +166,7 @@ jobs:
       - name: Validate PRs
         id: validate
         env:
-          GH_TOKEN: ${{ secrets.FARM_PAT }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PRS_JSON: ${{ needs.identify-passed-prs.outputs.prs_to_process }}
           DRY_RUN: ${{ inputs.dry_run }}
         run: |
@@ -384,7 +384,7 @@ jobs:
 
       - name: Send dispatch to Hypatia
         env:
-          GH_TOKEN: ${{ secrets.FARM_PAT || secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN || secrets.GITHUB_TOKEN }}
           PR_COUNT: ${{ needs.identify-passed-prs.outputs.pr_count }}
           VALIDATED_JSON: ${{ needs.validate-prs.outputs.validated_prs || '[]' }}
           MERGED_COUNT: ${{ needs.auto-merge-prs.outputs.merged_count || '0' }}

.github/workflows/supervised-fleet-scan.yml

@@ -46,14 +46,14 @@ jobs:
           INVENTORY_FILE: ${{ github.event.inputs.inventory_file || '' }}
           PROCESS_FINDINGS: ${{ github.event.inputs.process_findings || 'true' }}
           FLEET_SUPERVISED_REPOS_FILE: ${{ github.event.inputs.inventory_file || '' }}
-          # FLEET_SCAN_PAT is required for Hypatia's DependabotAlerts
+          # HYPATIA_SCAN_PAT is required for Hypatia's DependabotAlerts
           # rule (DA001-DA004) to query per-repo Dependabot alerts via
           # the GitHub REST API. This PAT must have `security_events: read`
           # scope on ALL target repos. Without it, cross-repo alerts will
           # be MISSING. The built-in GITHUB_TOKEN is insufficient for
           # estate-wide scanning. See:
           # 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
-          GITHUB_TOKEN: ${{ secrets.FLEET_SCAN_PAT }}
+          GITHUB_TOKEN: ${{ secrets.HYPATIA_SCAN_PAT }}
           # HYPATIA_SEVERITY=low surfaces low-severity findings from
           # every rule module. The Hypatia CLI's default threshold is
           # "medium"; without this override, low-severity findings