docs(agent): github actions scopes: add the token input, correct the event guard

[mergify-ci-bot]

The Monorepo CI workflow on the GitHub Actions page called the scopes action
with action: scopes and nothing else. Detection and job skipping work that
way, but sending the detected scopes back to Mergify does not, and that upload
is the whole reason the same section points readers at Merge Queue Scopes. The
example now passes token: ${{ secrets.MERGIFY_TOKEN }}, and a short paragraph
says what the token buys and that wait-jobs needs none. It also names the
scope: the scopes-upload endpoints accept only a key with the ci scope and
reject an admin one, which matters more than usual here because a reader
setting up Terraform on a neighbouring page is told to use an admin key. A
repository whose pull requests come from Dependabot needs the secret in its
Dependabot secrets too, so that is noted as well. This matches the Buildkite
page, which has explained the equivalent for its plugin all along.

The caution above the example claimed the action "requires a pull request
context" and that a push trigger would cause failures. It does not: on a
pull_request event the action works out the base and head to diff on its own,
and on any other event there is simply nothing to derive them from, which is
what the base input is for. Guarding the job with
if: github.event_name == 'pull_request' is still one valid answer, so it
stays, but it is now one of two rather than a workaround for a failure that does
not happen. The caution also notes that the upload is a no-op outside a pull
request, which is why passing base on a push is a supported thing to do rather
than a half-configured one.

Evidence: the action's declared inputs, a production deployment workflow that
runs action: scopes on push with an explicit base, the security scheme the
scopes endpoints declare in the API schema, and the CLI reference for the
command the action wraps, which documents the no-op exit.

[mergify]

Merge Protections

🟠 1 of 6 protections blocking · waiting on 🤖 CI

	Protection	Waiting on
🟠	🤖 Continuous Integration	🤖 CI
🟢	👀 Review Requirements	—
🟢	Enforce conventional commit	—
🟢	🔎 Reviews	—
🟢	📕 PR description	—
🟢	🚦 Auto-queue	—

🟠 🤖 Continuous Integration

Waiting for

• check-success = diagram-tokens

Waiting checks: diagram-tokens.

• all of:
  • check-success = diagram-tokens
  • check-success = build
  • check-success = lint
  • check-success = test
  • any of:
    • check-success = test-broken-links
    • label = ignore-broken-links
  • any of:
    • -head-repo-full-name~=^Mergifyio/
    • check-success=Cloudflare Pages

---

Show 5 satisfied protections

🟢 👀 Review Requirements

• any of:
  • #approved-reviews-by >= 2
  • author = dependabot[bot]
  • author = renovate[bot]
  • all of:
    • -head ~= ^docs-agent/
    • author = mergify-ci-bot

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:

🟢 🔎 Reviews

• #changes-requested-reviews-by = 0
• #review-requested = 0
• #review-threads-unresolved = 0

🟢 📕 PR description

• body ~= (?ms:.{48,})

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.