Configure PAT-backed /run-all-tool-tests ChatOps

## Goal

Enable the already-present `/run-all-tool-tests` ChatOps command so a trusted maintainer can start the global lint/test workflow from an issue or pull-request comment.

This is optional infrastructure. Normal pull-request CI, scheduled/manual global CI, and Tool Shed deployment do not require this credential.

## Current state in `tools-iwc-lab`

- `.github/workflows/slash.yaml` listens for comments containing `/run-all-tool-tests`.
- The dispatch step runs only when the repository secret `PAT` is non-empty, so it currently skips safely.
- The command creates a `run-all-tool-tests-command` `repository_dispatch` event consumed by `.github/workflows/ci.yaml`.
- The global workflow reacts to the source comment, runs all repository tests, and posts its summary/run URL back to the source issue or PR.
- The command also supports optional Galaxy source overrides, for example:

```text
/run-all-tool-tests fork=galaxyproject branch=release_26.1
```

- `peter-evans/slash-command-dispatch` defaults to requiring the commenter to have `write` permission, limiting this resource-intensive command to trusted collaborators.
- `PAT` is unrelated to `TS_API_KEY` and `TTS_API_KEY`.

## How this appears to work in `tools-iuc`

Confirmed from the public repository:

- [`tools-iuc` uses the same `PAT`-backed slash workflow](https://github.com/galaxyproject/tools-iuc/blob/main/.github/workflows/slash.yaml).
- Its [global CI workflow](https://github.com/galaxyproject/tools-iuc/blob/main/.github/workflows/ci.yaml) consumes the same `run-all-tool-tests-command` event and uses the PAT for reactions/result comments.
- Public examples use both the default Galaxy branch and explicit overrides, such as [`branch=release_24.1`](https://github.com/galaxyproject/tools-iuc/issues/6051#issuecomment-2149386974) and [`fork=bernt-matthias branch=topic/bed-metadata`](https://github.com/galaxyproject/tools-iuc/issues/4755).
- Recent public `repository_dispatch` workflow runs are attributed to `mvdbeek`; this suggests the IUC secret is or was a PAT belonging to that maintainer account.

The last point is an inference: GitHub does not publicly expose the secret owner, token type, scopes, or rotation policy. We should not assume that the IUC credential arrangement is the preferred model for a new repository.

The [slash-command action documentation](https://github.com/peter-evans/slash-command-dispatch#token) says its dispatch token cannot be the workflow `GITHUB_TOKEN`. For a public organization repository, it documents a classic PAT with `public_repo` and `read:org`, created by an organization member.

## Proposed setup

Prefer a dedicated bot/service account over a maintainer's personal account so ownership, rotation, and offboarding are explicit.

- [ ] Choose and record the credential owner. Recommended: a `galaxyproject` bot/service account.
- [ ] Give that account membership in `galaxyproject` and write access to `galaxyproject/tools-iwc-lab`.
- [ ] Create an expiring PAT and record its owner, expiration date, and rotation contact outside the repository.
- Conservative/action-documented option: classic PAT with `public_repo` and `read:org`.
- Preferred if verified compatible: fine-grained PAT restricted to `galaxyproject/tools-iwc-lab`, with permissions sufficient to create repository dispatch events, inspect collaborator/PR context, and write issue/PR reactions and comments.
- [ ] If organization SAML SSO is enforced, authorize the token for `galaxyproject`.
- [ ] Store it as the Actions secret `PAT` without putting the value in an issue, PR, command argument, or tracked file:

```sh
gh secret set PAT --repo galaxyproject/tools-iwc-lab
```

- [ ] Comment `/run-all-tool-tests` on a test PR or issue from an account with write access.
- [ ] Verify the **Slash Command Dispatch** workflow succeeds and creates a `repository_dispatch` run of **Weekly global Tool Linting and Tests**.
- [ ] Verify the source comment receives a reaction and a final test-summary comment.
- [ ] Verify an override such as `/run-all-tool-tests branch=release_26.1` selects the requested Galaxy branch.
- [ ] Add a rotation reminder before the token expires and document who may rotate it.

## Acceptance criteria

- The repository contains an Actions secret named `PAT`; its value is never exposed.
- `/run-all-tool-tests` works for a write-or-higher collaborator and starts the global suite.
- A reaction and final results link appear on the source issue/PR.
- The default and explicit `fork`/`branch` cases are tested.
- Normal PR CI and Tool Shed deployment remain independent of the PAT.

## Rollback

Delete the `PAT` repository secret. The guarded dispatch step will return to its current safe no-op behavior while scheduled/manual CI and publishing continue to work.

Start by reading .github/workflows/slash.yaml and .github/workflows/ci.yaml to trace the guarded PAT dispatch and global workflow. Use `gh secret set PAT --repo galaxyproject/tools-iwc-lab` only after the credential owner, permissions, SSO, and rotation details are confirmed. Test `/run-all-tool-tests` on an issue or PR, including default and explicit fork/branch cases, and verify the dispatch run, reaction, final results comment, and unaffected normal CI.

Written by the indexing model from the issue text.