ci(alerts): avoid app token setup for alert tests

[JSONbored]

Summary

• keeps alert-test mode scoped to the Discord webhook secret path
• skips GitHub App token resolution when manually running alert-test
• adds a workflow regression assertion for the token-scope guard

Validation

• .venv/bin/python -m pytest -q
• .venv/bin/python -m aio_fleet security audit-workflows --path . --format json
• actionlint -shellcheck '' -pyflakes '' -ignore 'SC2129' .github/workflows/*.yml
• git diff --check
• CodeRabbit review: 0 findings