fix(budget): refuse to report a percentage the watchdog cannot substantiate

[ExtraToast]

What went wrong

My previous change (#132) made the watchdog go green, reporting:

::notice::pricing 0 run(s) from the Actions API
::notice::about 0 of 3000 included minutes used (0%)
::notice::below the 70% warning threshold; nothing to raise

It could read neither billing nor workflow runs, warned about both, and then reported a comfortable zero as a pass.

That is worse than the red it replaced — and worse in exactly the way my own commit message had warned against two commits earlier: "a budget watchdog that quietly reports 0% when it cannot read the budget is worse than one that is absent, because it looks like good news." I wrote that, then shipped the thing it describes. A false all-clear on a budget alarm is the precise failure the alarm exists to prevent.

The org is at 109% of its allowance while this reported 0%.

Fix 1 — refuse to report what cannot be substantiated

• Any rejected run-listing query → fail, naming the permission needed
• Zero runs across every private repo in a month → fail. That is not a small number, it is evidence the measurement did not happen

A partial read is no longer averaged into a reassuring percentage.

Fix 2 — best-effort capable token instead of an opt-in flag

create-github-app-token fails the job when asked for a permission the installation lacks — that is why the app-has-billing-permission flag existed. But continue-on-error: true on that one step achieves the same protection with nothing to configure, and an App that does hold the grants is used automatically.

capable mint (continue-on-error)  ->  organization-plan: read + actions: read
minimal mint (always succeeds)    ->  metadata + issues, only to file the alert

Token precedence: capable App token → BUDGET_TOKEN → minimal token. The flag is removed.

Verified against the exact production condition

A shimmed gh that 403s both billing and runs — reproducing what actually happened:

	before	after
billing 403 + runs 403	0 of 3000 (0%), exit 0	::error:: naming the grants, exit 1
billing reachable	3268 (109%), exit 1	3268 (109%), exit 1 — unchanged

::error::could not list workflow runs (50 query/queries refused), so the month cannot be priced.
::error::This needs actions: read across the org. Grant the App "Actions" (read) and
         "Organization plan" (read), accept the updated installation permissions,
         or supply BUDGET_TOKEN.

actionlint clean.

Honest status

The watchdog will stay red until the App gets actions: read (for the fallback) or organization-plan: read (for the exact figure), or a BUDGET_TOKEN is supplied. My attempt to remove that owner action did not succeed — it only moved which permission is needed.

Red-and-honest is the correct state for a deployed alarm that cannot see its subject. Tracked in #126.

Refs #126