fix: use PAT for coderabbit-auto-apply to avoid bot-skip

[Copilot]

Summary

CodeRabbit silently ignores @coderabbitai apply commands posted by github-actions[bot] — the default GITHUB_TOKEN identity. The apply comment must originate from a real GitHub user. This PR threads a human-user PAT (CR_APPLY_PAT, classic, repo scope) as github-token so the comment posts as a user CodeRabbit will act on. Note: auto_apply_suggestions in .coderabbit.yaml would eliminate the round-trip entirely but is a paid-only feature.

Changes

• Pass ${{ secrets.CR_APPLY_PAT }} as github-token in coderabbit-auto-apply.yml
• Add inline comment explaining why GITHUB_TOKEN cannot be used
• Add S4 to Security & Supply Chain table in docs/LEARNINGS.md
• Add PR Log entry in docs/LEARNINGS.md

One-time setup required: add a classic PAT with repo scope as repo secret CR_APPLY_PAT.

Agent Checklist

• npm run test:ci passes (all unit tests green, coverage not decreased)
• npm run build && npm run test:e2e passes (all E2E tests green)
• No generated files committed (script.js, styles.css, *-data.js)
• All dynamic innerHTML values pass through escHtml()
• No DOM references introduced in death-clock-core.js
• No new runtime npm packages added
• GitHub Actions uses: pins use a full commit SHA + inline semver comment
• PR title follows Conventional Commits (feat:, fix:, docs:, chore:, etc.)
• project-stats.yaml updated if this session merges one or more PRs
• Relevant entry added to docs/LEARNINGS.md (new pattern or lesson learned)

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b58dec5f-e70a-47d5-aa90-71595cbc52e0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch copilot/fix-coderabbit-comment-error

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}