Non-blocking review findings from PR #133 (1)

[twistedmelonman]

Non-blocking concerns raised while reviewing PR #133 (docs(dependabot): a fine-grained token cannot read private check runs).

None of these blocked the merge. They are batched into one issue so a
review's findings stay one unit of attention rather than 1 separate
tracking issues; tick items off as they are addressed, and close this issue
when the list is done or the remaining items are judged not worth doing.

• Fine-grained PAT cannot read private check runs — token strategy for the Dependabot digest is an undecided open question (twistedmelonman (PR author, MEMBER comment), docs/runbooks/dependabot-digest-tokens.md — "What a fine-grained token cannot do")
  The author reports that a bisect against the live token found commits/<sha>/check-runs returns DENIED and that fine-grained PATs have no Checks permission to grant, citing github.com/orgs/community/discussions/129512. They further report that GitHub answers statusCheckRollup with HTTP 200 and nulls every CheckRun rather than erroring, so on nightowlstudiollc/kebab-tax-netlify#280 eleven of twelve contexts came back null. This PR documents the finding; the runbook itself states the three ways forward (classic PAT, GitHub App, public-only coverage) as an explicitly open decision, and says the workflow will keep failing on private repos until it is made. Per the author, fix(dependabot): refuse a check rollup the token could not fully read #134 (merged) is the code-side defence and docs(dependabot): plan the move from fine-grained PATs to a GitHub App #135 plans the GitHub App migration — so the tracking may already exist in docs(dependabot): plan the move from fine-grained PATs to a GitHub App #135, but the decision itself is not yet taken.