docs(skills): record the ingestion-pipeline failure modes in ci-tooling

[castrojo]

Session write-back per docs/skills/meta-skill-improvement/SKILL.md.

Adds the durable lessons from unbreaking the dashboard ingestion pipeline:

• Deploy-key publishing — GITHUB_TOKEN has no ruleset bypass, and the merge-queue route is a dead end because it may not start workflows (bot-enqueued merge groups never get a merge_group run and hang at AWAITING_CHECKS). Only OrganizationAdmin and DeployKey work as bypass actors.
• Private URLs as public evidence — the bug that does not reproduce locally, because a developer PAT has scopes GITHUB_TOKEN lacks.
• Hardcoded dataset counts in tests that gate the whole workflow.
• CI actionlint is stricter than local just lint (shellcheck/SC2016).
• Red flag: a workflow red for hundreds of runs — check whether a ruleset was created around the last green run.
• Verification: publishing workflows must be proven by an unattended scheduled run, not a dispatch.