Authenticate GitHub policy checks in the security audit

[nedtwigg]

The security audit in #71 ended INCONCLUSIVE because its agent had no GitHub credential for the live environment branch-policy and main rules checks. Unauthenticated requests hit the runner's API rate limit even though both settings were correct.

Supply the existing workflow token as GH_TOKEN, using the permissions already granted to the job. Redact that token from both the report and transcript before publication, and clarify that the auditor must fetch the live policies with pagination and retain UNVERIFIABLE on API errors.

Validation:

• All 31 script tests pass with node --test scripts/*.test.mjs, including regression coverage for token availability and redaction from both published files. The new checks failed before the fix.
• Confirmed the live environment allows only the main branch and the active branch rules require pull requests and block force-pushes and deletion.
• Formatted the changed files and passed git diff --check.

The hosted audit remains to be validated after merge; pushing the merge commit to main starts it automatically.

Fixes #71.