ci: make unattended workflow failures team-visible - #2734

Description

closes #2204

Adds a default-branch workflow_run monitor for unattended CI, test, and
security workflows. An actionable failure opens a rolling GitHub issue labeled
bug, CI/CD, and triage; later failures are added as comments, and the next
successful run in the same trigger scope records recovery and closes it.

Scheduled and main-push health are tracked independently. The monitor ignores
PR, manual, and expected push-cancellation results, deduplicates event
deliveries, queues concurrent updates, and rejects stale completions so
out-of-order delivery cannot leave the incident in the wrong state. It uses the
repository GITHUB_TOKEN and does not require a new notification secret.

Validation

• pre-commit run --all-files
• actionlint with ShellCheck enabled
• Eight mocked GitHub API scenarios covering first failure, repeated failure,
  duplicate delivery, recovery, trigger-scope isolation, stale completion,
  ignored cancellation, and duplicate incident recovery

GitHub only dispatches workflow_run listeners present on the default branch,
so end-to-end event delivery can be observed after this workflow lands.

Checklist

• New or existing tests cover these changes.
• The documentation is up to date with these changes.