ci: cut Actions burn — scope push triggers + concurrency-cancel - #9

## What changed

- moves allow-list detection/remediation to the centrally enforced
organization policy endpoint
- fails closed on API and response-shape errors instead of converting
them into healthy results
- inspects the latest run of every active workflow for startup and
billing health
- normalizes/deduplicates the canonical allow-list before compare/write
- makes D-BURN detection order-independent and remediation
default-branch-aware/idempotent
- makes dry-run reporting non-mutating and closes the rolling issue only
after a complete finding-free live sweep
- SHA-pins and lock-records the sweep's own checkout dependency
- updates operator documentation and the issue #14 remediation record

## Root cause

The original system tried to mutate repository allow-lists even though
GitHub centrally enforced the setting at organization scope; those
writes return HTTP 409. It also suppressed API errors and treated a
capped historical run page as current health. Separately, the sweep
itself used a mutable checkout ref under an organization policy
requiring SHA pins, so all seven scheduled runs ended in zero-job
startup failure.

## Live estate work completed

- enumerated 34 non-archived, non-fork source repositories (the issue's
historical horizon was 28)
- reconciled the inherited 20-pattern setting against 118 unique
canonical patterns
- applied and read back all 118 patterns at the organization endpoint
- opened metadatastician/_pathroot#9 for the three current D-BURN
findings

## Validation

- `bash -n scripts/ci-health/*.sh`
- `shellcheck scripts/ci-health/*.sh`
- `actionlint .github/workflows/ci-health-sweep.yml`
- `git diff --check`
- `gh actions-lock .github/workflows/ci-health-sweep.yml --no-fix
--json=valid,findings,dependencies` → `valid: true`
- fail-closed negative probe → exit 2 + `E-INSTRUMENT`
- live organization detector after update → exit 0, no allow-list
finding

Closes #14