ci: require org token for feedback sweeps

[haasonsaas]

Summary

• stop feedback sentinel/backfill workflows from falling back to repo-scoped github.token
• add explicit preflight failures when EVALOPS_REVIEW_GUARD_TOKEN is missing
• prevent falsely empty org-wide ledgers/reports when token scope cannot see EvalOps PRs

Verification

• actionlint .github/workflows/review-feedback-backfill.yml .github/workflows/review-feedback-sentinel.yml
• YAML parse check for both workflows
• ruby -c .github/scripts/sweep-recent-review-feedback.rb
• ruby -Itest test/sweep_recent_review_feedback_test.rb

Context

A manually dispatched backfill run succeeded but published an empty report because the workflow could fall back to repo-scoped github.token. This PR makes that failure loud instead of silently producing bad evidence.

[cursor]

PR Summary

Low Risk
Low risk: workflow-only changes that tighten authentication requirements and fail fast when the required secret is missing. Main impact is operational—scheduled/manual runs will now error instead of producing incomplete results if the org token isn’t configured.

Overview
Tightens GitHub Actions auth for review-feedback sweeps/backfills. The review-feedback-sentinel and review-feedback-backfill workflows no longer fall back to github.token, and instead require secrets.EVALOPS_REVIEW_GUARD_TOKEN.

Adds a preflight step that hard-fails with a clear error message when GH_TOKEN is unset, preventing silently empty ledgers/reports when the job lacks org-wide PR read access.

^{Reviewed by Cursor Bugbot for commit dd901fb. Bugbot is set up for automated code reviews on this repo. Configure here.}