fix(ci): correct 3 secret-name mismatches causing silent no-ops

Found during a post-breach credential audit: these workflows reference
secret names that don't exist on this repo, so the affected steps
silently degrade (empty token / fallback) instead of failing loudly.

- supervised-fleet-scan.yml: referenced secrets.FLEET_SCAN_PAT, which
  has never existed here — only HYPATIA_SCAN_PAT is configured, and
  its scope (Contents+Dependabot alerts read) is exactly what this
  step's own comment says it needs. Pointed it at the secret that
  actually exists.
- inbox-steward.yml "Validate PRs": referenced secrets.FARM_PAT (never
  configured). This step only reads check-runs/reviews/PRs on this
  same repo — it never needed a cross-repo PAT. Switched to
  secrets.GITHUB_TOKEN, which is sufficient and always present.
- inbox-steward.yml "Send dispatch to Hypatia": same missing FARM_PAT
  reference, but this step genuinely dispatches cross-repo, so it
  keeps the same PAT-with-fallback shape — just pointed at
  FARM_DISPATCH_TOKEN, the secret that's actually meant to carry that
  capability (currently dead pending redistribution of the new
  FARM_DISPATCH_PAT value, tracked separately).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/inbox-steward.yml

@@ -166,7 +166,7 @@ jobs:
       - name: Validate PRs
         id: validate
         env:
-          GH_TOKEN: ${{ secrets.FARM_PAT }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PRS_JSON: ${{ needs.identify-passed-prs.outputs.prs_to_process }}
           DRY_RUN: ${{ inputs.dry_run }}
         run: |
@@ -384,7 +384,7 @@ jobs:
 
       - name: Send dispatch to Hypatia
         env:
-          GH_TOKEN: ${{ secrets.FARM_PAT || secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN || secrets.GITHUB_TOKEN }}
           PR_COUNT: ${{ needs.identify-passed-prs.outputs.pr_count }}
           VALIDATED_JSON: ${{ needs.validate-prs.outputs.validated_prs || '[]' }}
           MERGED_COUNT: ${{ needs.auto-merge-prs.outputs.merged_count || '0' }}

.github/workflows/supervised-fleet-scan.yml

@@ -46,14 +46,14 @@ jobs:
           INVENTORY_FILE: ${{ github.event.inputs.inventory_file || '' }}
           PROCESS_FINDINGS: ${{ github.event.inputs.process_findings || 'true' }}
           FLEET_SUPERVISED_REPOS_FILE: ${{ github.event.inputs.inventory_file || '' }}
-          # FLEET_SCAN_PAT is required for Hypatia's DependabotAlerts
+          # HYPATIA_SCAN_PAT is required for Hypatia's DependabotAlerts
           # rule (DA001-DA004) to query per-repo Dependabot alerts via
           # the GitHub REST API. This PAT must have `security_events: read`
           # scope on ALL target repos. Without it, cross-repo alerts will
           # be MISSING. The built-in GITHUB_TOKEN is insufficient for
           # estate-wide scanning. See:
           # 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
-          GITHUB_TOKEN: ${{ secrets.FLEET_SCAN_PAT }}
+          GITHUB_TOKEN: ${{ secrets.HYPATIA_SCAN_PAT }}
           # HYPATIA_SEVERITY=low surfaces low-severity findings from
           # every rule module. The Hypatia CLI's default threshold is
           # "medium"; without this override, low-severity findings