Keep issue metadata tooling in existing dependency scans

Exact PR2888 smoke job 115991110826 exposes two coverage failures: the integrated .github/scripts npm lock was omitted from Dependabot and the weekly complete/production audit matrix. Include that existing module in both unchanged scan routes; retain all audit findings, review groups and immutable action pins.

Contract-Neutral: Scan coverage integration correction for an existing tooling module; no product runtime, dependencies, permission, audit threshold or release behavior changes.
Change-source: pulse-maintainer

.github/dependabot.yml

@@ -67,6 +67,7 @@ updates:
   - package-ecosystem: "npm"
     directories:
       - "/"
+      - "/.github/scripts"
       - "/frontend-modern"
       - "/internal/cloudcp/portal/frontend"
       - "/tests/integration"

.github/workflows/security-scan.yml

@@ -426,6 +426,8 @@ jobs:
         include:
           - name: root tooling
             directory: '.'
+          - name: issue metadata tooling
+            directory: '.github/scripts'
           - name: product frontend
             directory: 'frontend-modern'
           - name: account frontend