Sprint B.9+B.10: Dependabot alerts + CI status in table, cache and CLI

- Provider::org_dependabot_counts: one org-level request per distinct owner
  (cursor pagination via Link header — page= returns 400 on this endpoint);
  403/404 → None (unknown) vs Some(0) = checked, none open
- Provider::latest_ci_status: latest Actions run on the repo's branch →
  success/failure/running; CiStatus enum with stable string form
- cache RepoMeta: ci_status + dependabot_open replace unused ci_ok;
  RepoSummary carries both, applied at startup/scan/refresh (TUI + CLI)
- Repos table: CI column (✓/✗/●) + ALERT column (count, red when >0,
  '—' = unknown); CLI: list --alerts filter, scan_repos now cache-enriched
- verified against live API: 49 repos, 44 with alert counts, CI statuses
  match reality; table rendering checked via pyte

src/cli_cmds/workspace.rs

@@ -9,13 +9,14 @@ use anyhow::Result;
 pub fn list(
     cfg: &AppConfig, json: bool,
     dirty: bool, behind: bool, ahead: bool,
-    lang: Option<String>, project: Option<String>,
+    lang: Option<String>, project: Option<String>, alerts: bool,
 ) -> Result<()> {
     let mut repos = scan_repos(cfg);
 
     if dirty  { repos.retain(|r| r.is_dirty); }
     if behind { repos.retain(|r| r.behind > 0); }
     if ahead  { repos.retain(|r| r.ahead > 0); }
+    if alerts { repos.retain(|r| r.dependabot_open.unwrap_or(0) > 0); }
     if let Some(l) = lang {
         let l = l.to_lowercase();
         repos.retain(|r| r.lang.as_deref().map(|x| x.to_lowercase().contains(&l)).unwrap_or(false));
@@ -44,11 +45,19 @@ pub fn list(
         if r.is_dirty   { flags.push('⚠'); }
         if r.behind > 0 { flags.push('↓'); }
         if r.ahead > 0  { flags.push('↑'); }
-        println!(
-            "{:<name_w$}  {:<12}  {:<3}  {}",
-            r.name, r.branch, flags,
-            r.lang.as_deref().unwrap_or("-"),
-        );
+        if alerts {
+            println!(
+                "{:<name_w$}  {:<12}  {:>3} alerts  {}",
+                r.name, r.branch, r.dependabot_open.unwrap_or(0),
+                r.lang.as_deref().unwrap_or("-"),
+            );
+        } else {
+            println!(
+                "{:<name_w$}  {:<12}  {:<3}  {}",
+                r.name, r.branch, flags,
+                r.lang.as_deref().unwrap_or("-"),
+            );
+        }
     }
     Ok(())
 }