feat(add-to-project): add an org-wide backfill scope

[ExtraToast]

What

Adds a scope: org input to the reusable add-to-project.yml. When set, it boards every open issue and pull request across the whole organization instead of just the calling repo.

Why

Boarding an issue costs a billable minute in whichever repo fires the event. The private repos fire ~130 of those a week — ~516 minutes/month — for a job that averages 7 seconds and touches no repository content at all. It is pure Projects-V2 GraphQL.

The key fact: Actions minutes are billed to the caller, never to the repo holding the reusable workflow. The existing uses: shims into this repo already centralise the code, and that saves exactly nothing — a private repo firing the event pays for the run.

The only way this work stops costing minutes is for the run itself to be triggered in a public repo, where standard runners are free. That is what scope: org enables, driven by the scheduled caller in JorisJonkers-dev/.github (companion PR).

Behaviour

scope: repo is the default and existing behaviour is untouched — event-driven adds, manual single-URL adds, and the per-repo backfill all work exactly as before.

Two details worth reviewing

collect_repo writes to a file rather than returning URLs on stdout. Calling it inside a command substitution would run it in a subshell — losing the unreachable counter, and capturing the ::warning:: lines into the URL list instead of emitting them. I wrote it the naive way first and caught this before pushing.

Unreadable repos warn but don't fail an org-wide sweep. A repo the App was never granted is a fact about installation scope, not about the board. For a single named repo it stays a hard error, because the caller asked for exactly that one.

The token now also requests metadata: read, needed to enumerate the org's repositories.

Verification

I ran the collection logic against the live org:

::notice::org-wide backfill across 30 repo(s) in JorisJonkers-dev
RESULT: 159 open issue/PR urls collected, 0 unreadable repo(s)

actionlint and shellcheck -S warning both clean.

The add itself is unchanged and already idempotent — addProjectV2ItemById returns the existing item on re-add — which is what makes a 15-minute sweep safe.

Closes #122