fix(ci): pass GITHUB_TOKEN to Hypatia scanner in reusable workflow

[hyperpolymath]

The reusable scan workflow never set GITHUB_TOKEN in the "Run Hypatia scan" step, so the scanner's Dependabot / code-scanning / secret-scanning alert checks were always skipped with "GITHUB_TOKEN not set" warnings across every repo that calls this workflow.

Set it to secrets.HYPATIA_SCAN_PAT || secrets.GITHUB_TOKEN:

• Prefer a fine-grained, read-only PAT inherited as an org Actions secret (HYPATIA_SCAN_PAT) -- the built-in Actions token CANNOT read Dependabot alerts (no dependabot permission exists for GITHUB_TOKEN).
• Fall back to the built-in token so code-scanning alerts still resolve in repos where the PAT is not present yet.

This silences the three warnings fleet-wide once the org secret exists. It does not change the severity gate (medium+ findings still fail CI).

Claude-Session: https://claude.ai/code/session_01V13sGvHnaeCY5A9fF2QsDm

Summary

Closes #

Type of change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (would change existing behaviour)
• 🕳️ Soundness fix (fixes a checker/proof false-negative)
• 📖 Documentation
• 🧹 Refactor / tech debt (behaviour-preserving)
• ⚡ Performance
• 🔧 Build / CI / tooling

How has this been verified?

Checklist

• My commits are signed (git commit -S).
• I ran the project's own checks/tests locally and they pass.
• New files carry the correct SPDX-License-Identifier (code/config MPL-2.0,
  prose CC-BY-SA-4.0); I did not relicense existing files.
• Docs are updated, and no public claim now overstates what the code does.
• I have not introduced a soundness hole (or I have flagged where I might have).

Notes for reviewers