Board the SDK watch and monthly dependency-refresh issues with the GitHub App token #2548

Problem

Two of the repo's three issue-filing sweeps never board what they file, and AGENTS.md records why: no board credential exists.

• SDK watch (sdk-watch.yml) files issues labeled v2 + chore + dependencies, milestoned, never boarded.
• Monthly dependency refresh (dependency-refresh.yml) files its tracking issue, milestoned, never boarded.

Each arrives unboarded and waits for /issue-triage. During the v2.9.0 release, #2521 and #2522 (the SDK bumps) had no cards until triage placed them by hand.

Change

Once the GitHub App exists (#2544), give both workflows the same App-token step as the Dependabot sweep, and have each place its issue on board #28:

• the SDK watch at Todo with a rubric-derived priority, or a stated standing default
• the monthly refresh at Todo / Low, or as decided

Keep each sweep's rule that no model runs in a write-capable job. In sdk-watch.yml the boarding belongs in the sweep or post job, never in analyze.

Acceptance

• Both sweeps board their issues when the App secrets are present, and degrade to today's behavior when absent
• AGENTS.md's "never boards" statements are updated in the same change

Blocked on

#2544 (the GitHub App). Part of tracker #2543.