Install spectacles SDD suite (ref: v0.1.0) - #307

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/sdd-dispatch.yml:
- Around line 293-303: The current try/catch around github.rest.issues.addLabels
swallows errors by calling core.info, which lets the run continue even if arming
the tracking issue fails; change the catch to fail the workflow instead (e.g.,
call core.setFailed with a message including err.message or rethrow the error)
so any failure in github.rest.issues.addLabels (with context and tracking
identifiers) stops the job and prevents proceeding without the sdd:dispatched
label.

In @.github/workflows/sdd-monitor.yml:
- Around line 126-138: The App token creation currently uses
actions/create-github-app-token@v3 without scoping permissions, so update the
Mint App token step (actions/create-github-app-token@v3) to include explicit
permission-* inputs to follow least privilege—add permission-actions: read,
permission-pull-requests: read, permission-issues: write and optionally
permission-contents: read if the sdd-monitor action
(norrietaylor/spectacles/.github/actions/sdd-monitor@v0.1.0) needs repo file
access; keep using the generated token (steps.app.outputs.token) for the
sdd-monitor step after adding these inputs.

---

Nitpick comments:
In @.github/workflows/sdd-review.yml:
- Around line 45-58: The route job currently always runs and invokes the
external action (uses: norrietaylor/spectacles/...sdd-route-review@v0.1.0) even
for non-sdd PRs; add a job-level conditional to short-circuit the entire route
job by gating it on the PR head ref starting with "sdd/" (use the GitHub Actions
expression that checks github.head_ref or startsWith(github.head_ref, 'sdd/'))
so the job (route) — including the Decide step (id: decide) — never launches for
non-sdd/* head refs.