chore: document CLA_ASSISTANT_PAT rotation + evaluate GitHub App migration

[millerjp]

Summary

CLA_ASSISTANT_PAT is a long-lived admin-scoped PAT that bypasses branch protection on every signature commit. Today the expiry is tribal knowledge; no workflow warns before it expires.

Scope

Two-part:

1. Document the PAT's scope, expiry, and rotation procedure in SECURITY.md (or a new docs/secrets.md).
2. Evaluate migrating to a fine-grained GitHub App installation token scoped to contents: write on this repo only. If feasible, open a follow-up issue with the implementation plan.

Acceptance criteria

1. Documented rotation procedure exists and is linked from SECURITY.md.
2. Scheduled GH Action warns 14 days before the documented expiry date.
3. Migration decision recorded (either: implementation issue opened, or rationale for keeping the PAT documented).

Source: devops.