ci(supervised-fleet-scan): pass GITHUB_TOKEN + lower threshold to surface Dependabot findings

Fixes two silent-drop defects in the scheduled fleet scan workflow:

1. GITHUB_TOKEN was not passed to the fleet-coordinator env, so the
   Hypatia DependabotAlerts rule (DA001-DA004) always returned
   `{:error, "GITHUB_TOKEN not set"}` and no alerts were ever
   surfaced. Three low-severity CVEs on hyperpolymath/007 sat
   open for weeks partly for this reason.

   Token resolution order: secrets.FLEET_SCAN_PAT (preferred,
   needs `security_events` scope on every target repo) ->
   secrets.GITHUB_TOKEN (fallback — only scopes this repo).
   For a real estate-wide scan the PAT is required; otherwise
   the workflow only ever queries alerts on gitbot-fleet itself.

2. HYPATIA_SEVERITY defaulted to "medium", which filtered out every
   low-severity finding from every rule (not just Dependabot). Now
   set to "low" so the scan surfaces the full picture; downstream
   dispatch/review still gates behaviour per severity.

Pairs with:
- verification-ecosystem/hypatia@75a36ce (exported-severity floor
  so fresh-low Dependabot alerts reach default threshold)
- 007-lang@769fed0 + rsr-template-repo@80a66ae (per-repo
  hypatia-scan.yml now passes its own built-in token through and
  declares security-events: read)

See 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md
for the full chain audit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/supervised-fleet-scan.yml

@@ -43,6 +43,22 @@ jobs:
           INVENTORY_FILE: ${{ github.event.inputs.inventory_file || '' }}
           PROCESS_FINDINGS: ${{ github.event.inputs.process_findings || 'true' }}
           FLEET_SUPERVISED_REPOS_FILE: ${{ github.event.inputs.inventory_file || '' }}
+          # GITHUB_TOKEN is required for Hypatia's DependabotAlerts
+          # rule (DA001-DA004) to query per-repo Dependabot alerts via
+          # the GitHub REST API. The built-in secrets.GITHUB_TOKEN
+          # only has scope for the gitbot-fleet repo itself — for
+          # cross-repo scanning across the estate, promote this to a
+          # PAT secret (FLEET_SCAN_PAT) with `security_events` scope
+          # on every target repo. Without a valid token, the rule
+          # silently returns no findings and Dependabot alerts are
+          # missed. See
+          # 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
+          GITHUB_TOKEN: ${{ secrets.FLEET_SCAN_PAT || secrets.GITHUB_TOKEN }}
+          # HYPATIA_SEVERITY=low surfaces low-severity findings from
+          # every rule module. The Hypatia CLI's default threshold is
+          # "medium"; without this override, low-severity findings
+          # from any rule (not just DependabotAlerts) are dropped.
+          HYPATIA_SEVERITY: low
         run: |
           set -euo pipefail
           ARGS=(--limit "$LIMIT")