PAT rotation pre-expiry alerts

Cron that checks GH_DISPATCH_PAT expiry via GitHub API and alerts to #alerts-<team>-pipeline at T-60d, T-30d, T-7d, T-1d. Prevents silent auth failure on token expiration.