[P2] Establish GitHub App private key rotation policy

[nbrieussel]

Actions

• Enable secret scanning push protection on this repo (Settings → Code security)
• Annual rotation: generate new key → update secret → verify sync → revoke old key
• Set up yearly reminder (calendar or scheduled issue-opening workflow)
• Audit whether WEBHOOK_SECRET is actually used in Actions-only mode

Audit report — section 4