Security: Remove silent fallback in supervised-fleet-scan

Remove the || secrets.GITHUB_TOKEN fallback so the workflow fails
explicitly if FLEET_SCAN_PAT is not configured. Previously it would
silently miss cross-repo Dependabot alerts when using the default
GITHUB_TOKEN (which lacks security_events scope for other repos).

Now the workflow requires FLEET_SCAN_PAT with proper security_events
scope, or it will fail with a clear error instead of silent data loss.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

Author: hyperpolymath

.github/workflows/supervised-fleet-scan.yml

@@ -45,17 +45,14 @@ jobs:
           INVENTORY_FILE: ${{ github.event.inputs.inventory_file || '' }}
           PROCESS_FINDINGS: ${{ github.event.inputs.process_findings || 'true' }}
           FLEET_SUPERVISED_REPOS_FILE: ${{ github.event.inputs.inventory_file || '' }}
-          # GITHUB_TOKEN is required for Hypatia's DependabotAlerts
+          # FLEET_SCAN_PAT is required for Hypatia's DependabotAlerts
           # rule (DA001-DA004) to query per-repo Dependabot alerts via
-          # the GitHub REST API. The built-in secrets.GITHUB_TOKEN
-          # only has scope for the gitbot-fleet repo itself — for
-          # cross-repo scanning across the estate, promote this to a
-          # PAT secret (FLEET_SCAN_PAT) with `security_events` scope
-          # on every target repo. Without a valid token, the rule
-          # silently returns no findings and Dependabot alerts are
-          # missed. See
+          # the GitHub REST API. This PAT must have `security_events: read`
+          # scope on ALL target repos. Without it, cross-repo alerts will
+          # be MISSING. The built-in GITHUB_TOKEN is insufficient for
+          # estate-wide scanning. See:
           # 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
-          GITHUB_TOKEN: ${{ secrets.FLEET_SCAN_PAT || secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.FLEET_SCAN_PAT }}
           # HYPATIA_SEVERITY=low surfaces low-severity findings from
           # every rule module. The Hypatia CLI's default threshold is
           # "medium"; without this override, low-severity findings