fix(workflows): fail loudly and use one authority for Copilot label assignment #2080

Summary

Squad 0.13.1 generates Copilot assignment wiring with two false-success hazards for repositories that enable squad copilot --auto-assign:

1. squad-issue-assign.yml falls back from a missing COPILOT_ASSIGN_TOKEN to GITHUB_TOKEN. GitHub silently ignores the bot assignment with that token, so a successful workflow can leave an issue unassigned.
2. squad-heartbeat.yml contains a second label-triggered @copilot assignment path. It can duplicate assignment attempts and makes the source of assignment non-deterministic.

Both files are generated/upgrade-owned. A repository-local workflow edit is overwritten by squad upgrade, so the durable fix belongs in Squad.

Evidence

• Squad docs prescribe squad copilot --auto-assign and COPILOT_ASSIGN_TOKEN, but the generated workflows do not require the secret before attempting assignment.
• squad-issue-assign.yml uses ${{ secrets.COPILOT_ASSIGN_TOKEN || secrets.GITHUB_TOKEN }} for the Copilot assignment step.
• squad-heartbeat.yml also reacts to the squad:copilot label and invokes the same assignment behavior.
• Repository issue philips-internal/org-chart-automation-JavaScript#1015 documented the silent-success path; PR Built-in Agent: Aegis — Responsible AI Reviewer #1032 carried a local protective patch, but this does not correct fresh/upgrade-generated Squad workflow files.

Expected behavior

• A squad:copilot label with no COPILOT_ASSIGN_TOKEN causes the sole assignment job to fail explicitly before the routing comment or assignment attempt.
• Exactly one generated workflow is authoritative for label-triggered Copilot assignment.
• Tests cover missing-token failure and ensure the heartbeat workflow cannot attempt the same assignment.
• The documentation explains that a green workflow alone is not proof; a successful hand-off has a bot assignee, session/branch, and draft PR.

Reproduction

1. In a disposable private repository, run squad copilot --auto-assign and commit the generated files.
2. Do not add COPILOT_ASSIGN_TOKEN.
3. Add squad:copilot to a no-sensitive-data issue.
4. Observe that the assignment workflow can succeed without a copilot-swe-agent[bot] assignee, and that the heartbeat can independently react to the same label.

No credential value is needed to reproduce or diagnose the behavior.