Refresh expired COPILOT_GITHUB_TOKEN

Problem

COPILOT_GITHUB_TOKEN is returning HTTP 401 against the Copilot API proxy, so the Monthly SEO Review & Recommendations workflow (.github/workflows/SEOReport.md/.lock.yml) cannot execute its Copilot analysis step at all — every attempt fails at Execute GitHub Copilot CLI before it can analyze any data or call publish-report. Likely cause per Gilbert: exhausted Copilot usage/tokens on the account backing this secret.

This is the same failure signature behind the repeated "Secret Verification Failed" / workflow-failure notifications historically piling up on #75 (Feb, June, July 2026 runs) — it predates and is unrelated to the SEO metrics tracking redesign that just shipped. That redesign's stale-month refusal, verified collection, and Discord notifications are all confirmed working end-to-end against real data (see #103's closing comment) — the one missing piece is the analysis engine itself being able to authenticate.

Evidence: run 30498703939, agent job, Execute GitHub Copilot CLI step:

Authentication failed with provider at http://172.30.0.30:10002 (HTTP 401).
  Check your COPILOT_PROVIDER_API_KEY or COPILOT_PROVIDER_BEARER_TOKEN.

As a stand-in, the July 2026 report (SEO-REVIEW-2026-07.md) was produced manually rather than by the automated pipeline.

What to do

• Refresh/regenerate the credential backing the COPILOT_GITHUB_TOKEN repo secret (requires Gilbert's GitHub Copilot access — check current Copilot usage/seat status first, since a 401 here is consistent with an exhausted or expired token rather than a misconfiguration).
• Update the COPILOT_GITHUB_TOKEN secret in repo settings with the refreshed credential.
• Manually dispatch Monthly SEO Review & Recommendations (gh workflow run "Monthly SEO Review & Recommendations") against a month that doesn't yet have a report, and confirm the agent job completes and publish-report runs — this is the first real end-to-end automated run since the redesign in #103, so it's the actual proof the whole pipeline works unattended.
• Confirm the Discord success notification fires for that automated run (the notification code path was already verified manually in #103, but not yet triggered by a real Copilot-driven run).

Notes

This is a manual/credential task — an agent cannot regenerate a Copilot token or verify seat/usage status on Gilbert's account. Not part of the #103 spec; tracked separately since it's a pre-existing infra issue, not a design decision.

Start with .github/workflows/SEOReport.md and .lock.yml, then inspect the failed run's agent job and Execute GitHub Copilot CLI step. Check the account's Copilot usage or seat status before refreshing COPILOT_GITHUB_TOKEN. Update the repository secret, run gh workflow run "Monthly SEO Review & Recommendations" for an unreported month, and confirm agent, publish-report, and Discord success notification complete.