[product-manager-impersonator] Document GH_AW_GITHUB_TOKEN for label-trigger chaining

## Feature Idea

**Summary:** Add an onboarding callout that explains when to configure `GH_AW_GITHUB_TOKEN` so label-based downstream workflows work on first setup.

## Why a Customer Would Want This
Users installing workflows expect chaining to work after following top-level setup steps, but the main setup docs currently emphasize `COPILOT_GITHUB_TOKEN` and can leave teams unaware that label-trigger chaining needs an additional token path in some workflows.

## Rough Implementation Sketch
- Add a short "When you also need `GH_AW_GITHUB_TOKEN`" section in top-level setup docs (`README.md` and `docs/workflows/gh-agent-workflows.md`).
- Link directly to one concrete example (Issue Triage / Dependency Review) where label-based re-trigger behavior is documented.
- Add a 2-step checklist: keep `COPILOT_GITHUB_TOKEN` for engine auth; add `GH_AW_GITHUB_TOKEN` when using label-triggered downstream automation.
- Keep this as documentation-only (no runtime/workflow behavior changes).

## Why It Won't Be That Hard
This is a docs-only change using existing behavior and wording already present in workflow-specific docs; it mainly centralizes guidance in the first-run path where users start.

## Evidence
- `README.md:37-39` documents quick setup setting `COPILOT_GITHUB_TOKEN` but does not call out `GH_AW_GITHUB_TOKEN` for label-trigger chaining.
- `docs/workflows/gh-agent-workflows.md:132-139` focuses setup on `COPILOT_GITHUB_TOKEN`; `docs/workflows/gh-agent-workflows.md:145` only gives a generic note about additional secrets.
- `gh-agent-workflows/issue-triage/README.md:38-40` explicitly documents `GH_AW_GITHUB_TOKEN` for downstream label-triggered workflows.
- `gh-agent-workflows/dependency-review/README.md:38-40` has the same explicit `GH_AW_GITHUB_TOKEN` behavior.
- Example trigger comments already show this optional secret wiring: `gh-agent-workflows/issue-triage/example.yml:25-29`, `gh-agent-workflows/dependency-review/example.yml:30-34`.

## Non-duplicate check
- Not a duplicate of `#993` (focuses on missing **COPILOT** prerequisite placement on per-workflow quick-install pages).
- Not a duplicate of `#1087` / `#1088` (wording clarity in existing secret descriptions).
- Not a duplicate of existing product-manager ideas in `/tmp/previous-findings.json` (quick-setup modes/flags, compile targets, output parity/lints, replay/override features).

> [!NOTE]
>
> 🔒 Integrity filter blocked 28 items
>
> The following items were blocked because they don't meet the GitHub integrity level.
>
> - [#359](https://github.com/elastic/ai-github-actions/issues/359) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1067](https://github.com/elastic/ai-github-actions/issues/1067) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1024](https://github.com/elastic/ai-github-actions/issues/1024) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#140](https://github.com/elastic/ai-github-actions/issues/140) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#457](https://github.com/elastic/ai-github-actions/issues/457) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#197](https://github.com/elastic/ai-github-actions/issues/197) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#216](https://github.com/elastic/ai-github-actions/issues/216) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#235](https://github.com/elastic/ai-github-actions/issues/235) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#436](https://github.com/elastic/ai-github-actions/issues/436) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#473](https://github.com/elastic/ai-github-actions/issues/473) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#76](https://github.com/elastic/ai-github-actions/issues/76) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#875](https://github.com/elastic/ai-github-actions/issues/875) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#676](https://github.com/elastic/ai-github-actions/issues/676) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#694](https://github.com/elastic/ai-github-actions/issues/694) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#354](https://github.com/elastic/ai-github-actions/issues/354) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1025](https://github.com/elastic/ai-github-actions/issues/1025) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - ... and 12 more items
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Product Manager Impersonator](https://github.com/elastic/ai-github-actions/actions/runs/25913769232)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.