fix(ci): probe the dispatch token against both target repos, not just the tap

[acamarata]

The two dispatch steps in the publish job share one secret, HOMEBREW_TAP_TOKEN, but target different repos:

- name: Trigger homebrew tap update (stable only)
    token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
    repository: nself-org/homebrew-nself

- name: Trigger admin Docker rebuild (stable only — CLI↔Admin lockstep per S34-T12)
    token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
    repository: nself-org/admin

The preflight probe only checked nself-org/homebrew-nself.

So a PAT scoped to the tap but not to admin passes the gate, fires the tap dispatch, then fails on the admin dispatch — after the release has already published. The gate reports the token as good while half of what it authorises is unusable.

Change

The probe now loops over every repo it dispatches to and names the failing one in the warning. Whoever mints the replacement PAT needs repo scope on both repos; this proves it before either dispatch runs rather than after one has.

Verification

Simulated:

Case	homebrew-nself	admin	Result
Healthy token	200	200	tap_token_ok=true
Today's expired token	401	401	tap_token_ok=false
Tap-only PAT (the gap this closes)	200	404	tap_token_ok=false — previously would have half-succeeded

Per-repo probe results are echoed to the log, so a partial-scope token is diagnosable at a glance.

Context

• The admin side of that dispatch had no listener at all until fix(ci): listen for the cli-release dispatch and publish in lockstep admin#104 — cli-release went into the void on every release, which is why Docker Hub sits at 1.0.13 while CLI is at 1.3.6.
• HOMEBREW_TAP_TOKEN is still expired (HTTP 401 on the v1.3.6 run) and needs an owner to mint a replacement. This PR does not change that; it makes the eventual rotation verifiable.

No behaviour change while the token stays expired — the gate already fails closed, and the release itself is unaffected either way.