fix: the audit's token scope was one folded string, so both tokens were empty - #22

This change switches both GitHub App repository lists from folded to literal YAML scalars so the token action receives separate repository names. The regression test now parses the values using the action's separators and rejects folded, space-joined names.