collect_ndjson mention sanitizer ignores safe-outputs.github-token when resolving allowed-teams

[ivancea]

Summary

safe-outputs.mentions.allowed-teams works in Process Safe Outputs but fails during Ingest agent output (collect_ndjson_output.cjs). Mentions are backtick-escaped there with the default GITHUB_TOKEN, so by the time add_comment runs with the correct allowlist, the body is already `@user` and GitHub never notifies.

This is a follow-on to #42225 / #42313: that fix correctly honors pre-resolved aliases in add_comment, but an earlier sanitize path undoes it.

Expected

When safe-outputs.github-token is set (PAT with read:org), both:

1. Ingest agent output (collect_ndjson_output), and
2. Process Safe Outputs / add_comment

should use that token to resolve mentions.allowed-teams and preserve raw @login mentions for team members.

Actual

Stage	Token	Team members	Mention form
Agent MCP / safeoutputs.jsonl	n/a	n/a	raw @login
Ingest agent output (collect_ndjson)	default GITHUB_TOKEN	404 on GET /orgs/.../teams/.../members → allowlist collapses to dispatch actor only	body rewritten to `@login`
Process Safe Outputs / add_comment	safe-outputs.github-token	full team list (e.g. 31 members)	cannot unwrap already-backticked mentions → posted as `@login`

Compiled lockfile pattern:

• Ingest agent output: no github-token: override → GITHUB_TOKEN
• Process Safe Outputs: github-token: ${{ secrets.… }} from safe-outputs.github-token

Evidence (repro)

Private control-repo workflow with:

safe-outputs:
  github-token: ${{ secrets.MY_GH_TOKEN }}  # PAT with read:org
  mentions:
    allowed-teams:
      - my-org/my-team
  add-comment:
    # ...

Ingest logs:

[MENTIONS] Fetching members for 1 configured team(s)
GET /orgs/my-org/teams/my-team/members → 404
[MENTIONS] Cannot access team my-org/my-team (HTTP 404)
[OUTPUT COLLECTOR] Allowed mentions: <dispatch-actor>

Process Safe Outputs logs (same run): team fetch succeeds with the configured PAT; member is on the allowlist; posted comment still has `@member` because agent_output.json was already escaped at ingest.

Related: #42225 / #42313 (add_comment second-pass allowlist). Not caused by the allow-team-members → allowed-collaborators rename.

Suggested fix

One of:

1. Wire safe-outputs.github-token into the Ingest agent output actions/github-script step (same as Process Safe Outputs), so resolve_mentions_from_payload can list team members before sanitizing; or
2. Defer mention sanitization until Process Safe Outputs / handlers (where the configured token already runs), and keep ingest as structural validation only.

Option 1 is the smaller behavioral change if ingest must keep sanitizing.