Timeline: tag event stories with taxonomy data-* attributes (Code Scanning, Dependabot, Secret Scanning, Issues)

[janmaarten-a11y]

Part of github/primer#6664 (epic github/primer#6654).

This PR tags four Timeline event story surfaces with the taxonomy data-*
attribute contract: Code Scanning, Dependabot, Secret Scanning, and Issues.
It applies the same approach proven in the License Compliance pilot
(#8216), so the two together cover all five surfaces.

The change is Storybook-only and adds no consumer-facing behavior. It only
adds attributes to the rendered <li> rows, so visuals are unchanged. Each
surface lives in its own file, so the four changes are independent.

How it works

Every <Timeline.Item> for a cataloged event now spreads the data-*
attribute set produced by the taxonomy module (#8180,
packages/react/src/Timeline/taxonomy/), documented in github/primer#6888.
Each file adds a small local helper that calls the module's
toEventDataAttributes serializer and derives category and visibility
from that surface's catalog, so the stories stay in sync with the source of
truth rather than hand-typing values. data-actor-type resolves at runtime
from each row's rendered actor login via actorTypeForLogin, and is omitted
when a row renders no actor.

Timeline.Item forwards arbitrary props to its <li>, so the attributes
land directly on the row element.

What each surface tags

• Code Scanning: 15 rows. Detection group (detected, appeared,
  reappeared) and fixed are system events with no actor. Closures,
  reopen, and the delegated-dismissal pair carry user actors.
• Dependabot: 23 rows. opened and fixed render the Dependabot bot actor;
  dismissed and reopened fold manual (user) and automated (bot) paths;
  the delegated-dismissal group is reviews.
• Secret Scanning: 21 rows tagged, 11 left untagged (see below).
• Issues: 80 rows tagged, 5 left untagged. Metadata events (labels,
  assignees, milestones, project fields, issue types, rename) carry
  data-event-visibility="auditOnly" straight from the catalog.

Judgment calls and untagged rows for review

These are the places where the mapping was not a clean 1:1, called out so a
reviewer can confirm each one.

Code Scanning, configuration-deleted maps to closed: the two
"Configuration deleted" rows in EventFixed are the
ALERT_CLOSED_BECAME_OUTDATED event, which the catalog folds into closed
(a system closure), not fixed. They carry data-event-type="closed" and
no actor. The two "Fixed in branch" rows carry data-event-type="fixed".

Secret Scanning, GitHub system actor resolves to user: the system
"GitHub" identity on detected and the automated validity-change rows
resolves to data-actor-type="user", because actorTypeForLogin("GitHub")
returns user (GitHub is not in the bot set). Whether a system identity
should classify as user or bot is worth confirming.

Secret Scanning, rows left untagged because they have no catalog leaf or are
parked or shared:

• "Bypass requested" and "Bypass approved" (the delegated-bypass flow, which
  has no catalog leaf; the catalog's dismissal leaves are the separate
  delegated-closure flow)
• "Reported" (EventReport): the catalog maps Report to validity_changed,
  but github/primer#6888 flags that mapping as unconfirmed (open item 2), so
  the row is left untagged rather than emit an unconfirmed value
• "Dismissal request cancelled" (Secret Scanning has no dismissal_cancelled
  leaf, unlike Dependabot)
• EventMetadata "Extended metadata found" and "removed" (parked per
  github/primer#6888)
• EventAssignment (all five variants): a cross-surface shared event,
  deliberately out of the per-surface catalog

Issues, five variants left untagged. Each is a metadata or audit-only event
the taxonomy does not yet enumerate as a distinct leaf, so it is a candidate
leaf to add in a follow-up, not a defect. Tagging one now would mean emitting
a data-event-type with no catalog backing, which would break the single
source of truth:

• "Converted from draft"
• "Marked as canonical", "Unmarked as duplicate", "Unmarked as canonical"
  (the catalog has only marked_as_duplicate)
• "Labels added and removed" (one row representing two events, labeled
  plus unlabeled)

Dependabot's EventAssignment and EventCopilotWork are also left untagged
as shared and parked events, consistent with Secret Scanning.

Testing

Validated on the combined branch with the repo's own gates: prettier,
eslint, and type-check (15/15 tasks) all pass with zero new errors. Each
surface was additionally rendered headlessly in real Chromium on its own
branch, confirming the <li> rows carry the expected attributes and that
the untagged rows carry none, with zero console errors.

These files stay out of Timeline.docs.json and build.ts by design.

[changeset-bot]

⚠️ No Changeset found

Latest commit: d80fe45

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[janmaarten-a11y]

Superseded: folded these four surface files into #8216, which now covers all five surfaces (License Compliance + these four) in one PR. Closing this in favor of that.