chore: add Grafana alerts service account token (#16)

## What

Adds `grafana_alerts_token` to the SOPS secrets — the operator-generated
token minted by the `GrafanaServiceAccount` CR (kustomize-cluster#54),
retrieved from the cluster and written via `sops set`. Replaces the
placeholder distributed by #15.

On apply, `GRAFANA_ALERTS_TOKEN` becomes functional in all 11 active
repos and the Dependabot PR alerting pipeline goes end-to-end:

Dependabot PR → caller workflow → shared-workflows reusable workflow →
Cloudflare Access app → Grafana Alertmanager → Discord.

## Validation

- Token value handled entirely in subprocesses (kubectl → shell → sops
set); never exposed in logs or this PR.
- SOPS key existence verified post-write; `make test` hooks pass at
commit.
- Cluster-side objects confirmed synced: `grafanacontactpoint/discord`,
`grafananotificationpolicy/root-discord`,
`grafanaserviceaccount/github-actions-alerts`,
`secret/grafana-alerts-token`, `secret/discord-webhook`.

## After merge

End-to-end test: `@dependabot recreate` on cflan#9 → expect a Discord
message within a minute of the reopened PR.

Author: xnoto

secrets/secrets.yaml

@@ -19,13 +19,14 @@ www_aws_access_key_id: ENC[AES256_GCM,data:jb1vtp/sjpYE+9/ZxIhnpezUCzM=,iv:u5wB2
 www_aws_secret_access_key: ENC[AES256_GCM,data:x7YarHj9pKPiYHM04xkaU+fACjoOmM7eaMj1rU+iIYq2jYgY11X74g==,iv:NEY6uHKvIWnw7m8ym0cYVXDMvbmCu9iAZ5N9WGyZgYM=,tag:xL1Pgyidj4Nw73vKFeCziQ==,type:str]
 cloudflare_zone_id: ENC[AES256_GCM,data:6RjS806r2iMX9dfWBJeLIG54jRu3DhylNP7QOmrOVWc=,iv:picCNDWPduEMzqcm3gh7oRaGEs+4n2E/P91EGC/3iDs=,tag:9G/KG68JLu/rxI+fLpQQ7Q==,type:str]
 cloudflare_api_token: ENC[AES256_GCM,data:z5WDjwxFZ7VaufG17WciwbbOVQlaZP+OSGOkRCTJQJAPxZCv8pHc6Q==,iv:jiUky+4sIka3Kkw4JcteY2eoj8uzSwsMAREamseJ/Vo=,tag:ChGagBsNZKUVka6rlcB/FQ==,type:str]
+grafana_alerts_token: ENC[AES256_GCM,data:DHykbs4ifLhkmbrh9DdBO0oyjEGCjdxoaWa6juRyWQIWbtNkedYgWQ8LorZ6HQ==,iv:/dvVgkKmSp5sY/UlH+mPpF5v7HRDjgG1ok3tAW81niY=,tag:UaZyqVrWQW997/6jxqjD/A==,type:str]
 sops:
     kms:
         - arn: arn:aws:kms:us-west-2:332355796717:key/0a45c0f6-71dc-4d54-ab33-9df4de1a9e91
+          aws_profile: ""
           created_at: "2026-06-19T04:16:52Z"
           enc: AQICAHj1IggLFhM4nJnKEvmbEpk5E9RxZZoxpZYUW0taoyrz1AF/kg94UKFDzajWL4wI8KwkAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMmVOJEF56prSE5mcxAgEQgDt27+5rh3R0yvgpohI7YEEeZqxAJQiRdIomE22ohFcv2WGRfPXvbh43PlSwUAekZwmkLMM440d0Pu8zcA==
-          aws_profile: ""
-    lastmodified: "2026-06-19T04:13:08Z"
-    mac: ENC[AES256_GCM,data:l0RC91HKiFmaYRNLv07KJXwjAXm9HMvUUFCZmFMrJ1SoKn1ICoP+Lj64bIUCcKdnB5nrNNcyYvjgyhWssu0/wn5qMUH+9ZyWVDPhYj8GBGT7ZGuwbjNef8WV+WwyO8Qw4FDg6kesJeemuEwOHhXyaKOtZNb+kdWllFvjfsasZXs=,iv:kxf3aqVIJeZbUvzOtY6Uq4YpCkkStctezgy+91PpTJc=,tag:ScaLQ9zqj+Xuc5eCu+hxRQ==,type:str]
+    lastmodified: "2026-08-24T15:30:58Z"
+    mac: ENC[AES256_GCM,data:ntytB4EW4Oo3YaKoqi0BsOy6Ij4HRE6PJ+bEKXiS3pHpIww1OVFPAYWRJPosPpkn7AYX1iSF7p+w16FJs5vKqek2hnP4wWzDzWqbbFhJAurBEjwWilLi/Phxc5SArJsWghA8UMl4g6FkRBlYC6S4pnfsmX/t0bGtIDQasVZPLU0=,iv:xTKf3t/71gvLP/ygJLbiTtOTN/9ahs55hv6wE5LYB0o=,tag:X6oDOiXdp77v3dgIQD2gVw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2