Migrate AquaSec security issues from type:tech-debt to a dedicated type:aquasec label

### Feature Description

Replace the generic `type:tech-debt` label on AquaSec-generated security issues with a dedicated `type:aquasec` label, and narrow the issue-fetch filter to require both `scope:security` **and** `type:aquasec`.

### Problem / Opportunity

AquaSec issues are currently labelled `scope:security` + `type:tech-debt`. `type:tech-debt` is a general-purpose label that teams also apply to unrelated work, so it cannot be used to identify AquaSec-generated issues.

The sync currently fetches candidate issues by `scope:security` alone. That is too broad.

**Constraint that shapes the design:** the fetch decides *update vs. create*. If the fetch is narrowed to `type:aquasec` at the same moment the automation starts writing that label, every pre-existing issue (which only carries `type:tech-debt`) becomes invisible and every finding is re-created as a **duplicate**. The rollout therefore has to be split into two phases.

### Acceptance Criteria

**Phase 1 — write the new label, keep reading broadly**

1. New parent issues are created with `scope:security`, `type:aquasec`, `epic`; new child issues with `scope:security`, `type:aquasec`.
2. Label `type:aquasec` is auto-created in the target repo (idempotent) so no manual setup is required.
3. Required-label check validates `type:aquasec` instead of `type:tech-debt`.
4. A sweep migrates all existing AquaSec issues — **including closed ones and ones not matched by a current alert**. Adding `type:aquasec` and removing `type:tech-debt`.
5. Only issues carrying an AquaSec `secmeta` block are touched. Manually-created `scope:security` issues are never modified.
6. Label `type:tech-debt` is only un-assigned when the issue has **both** `scope:security` and `type:tech-debt`, and the repo-level label definition is never deleted.
7. Already-migrated issues cost zero API calls, so the sweep converges and nightly runs stay cheap.
8. The fetch filter is **unchanged** (`scope:security` only).

**Phase 2 — narrow the fetch, remove scaffolding (separate PR, ~1 month later)**

9. Fetch requires both `scope:security` and `type:aquasec`.
10. All migration scaffolding is removed; `grep -rn "MIGRATION-PHASE-2" src/ tests/` returns nothing.
11. `type:aquasec` documented as a prerequisite label (auto-create removed).

### Dependencies / Related

Phase 2 must not be merged until every consuming repo has had a successful run in the migration window.

This issue stays open after the Phase 1 PR merges; it is closed by the Phase 2 PR.