dot-project-sync gets 403 on the openfga org because the shared GitHub token is a classic PAT

Every production sync run fails against `openfga/.project` with HTTP 403. The `openfga` GitHub org forbids access via classic personal access tokens, and the `GITHUB_API_TOKEN` shared through the `maintainerd-server-env` secret is a classic PAT with broad scopes (`admin:org, audit_log, gist, project, repo, user, workflow`). The run survives the error (error-classification fix already landed), but that project gets no LFX/identity coverage on any run.

**Why we can't just swap the shared token's value:** six workloads consume `maintainerd-server-env` via `envFrom` (server deployment, web-bff, fossa-poller, github-profile-sync cronjob + job, onboarding-backfill, dot-project-sync), and web-bff publishes gists with this token — fine-grained PATs do not support the Gist API. An in-place swap to a fine-grained token would silently break gist publishing.

**Fix:**
1. Mint a dedicated fine-grained PAT for the sync: repository access "Public repositories", read-only, no extra permissions. That covers everything the sync reads (repo contents/metadata via REST, commits/PRs/reviews via REST, blame via GraphQL) and satisfies the openfga org policy.
2. Add it to the secret under a new key, `DOT_PROJECT_SYNC_GITHUB_TOKEN`, leaving the existing `GITHUB_API_TOKEN` untouched.
3. Override the env in `deploy/manifests/dot-project-sync-cronjob.yaml` with an explicit `env:` entry sourcing `GITHUB_API_TOKEN` from the new key (explicit `env:` beats `envFrom`, so no Go change is needed).

**Verification:**
- `GET /repos/openfga/.project` returns 200 with the new token (403 with the old one).
- One GraphQL blame query succeeds with the fine-grained token before the PR-provenance work ships, since that path depends on GraphQL.
- Next full sync: openfga produces observations; run-level `errored` count drops accordingly.

**Rotation:** fine-grained PATs expire after at most one year. Record the expiry date in a comment here when minted, and set a reminder — an expired token will silently zero out sync coverage.

**Follow-ups this folds into:** per-workload least-privilege tokens as part of the `maintainerd-server-env` cleanup; the current shared token's scopes are far broader than any code path requires. If #148 lands first, step 2 happens as part of re-sealing that secret.