chore(deps): address Copilot review round 5 on #2243

Both findings were "previously missed" suppressed ones; the two against
scripts/dependency-refresh.mjs and its workflow are relayed to #2239.

- Serialize the sweep with a fixed concurrency group and
  cancel-in-progress: false. The marker check is a read-before-write and
  a workflow_dispatch can land on top of the scheduled run, so two runs
  could both see no open issue and both file one — the duplicate the
  whole idempotency design exists to prevent. The queued run must wait
  and re-read, never be cancelled.
- Pick the milestone in JS, not in jq. jq sorts null before every
  string, so sort_by(.due_on) | .[0] returns an UNDATED open milestone
  in preference to every dated one. An undated bucket has no due date
  and so cannot be the nearest; pickMilestone drops it, and files the
  issue unmilestoned if nothing dated is open.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013H6Cew3KB3jVmQ5x4Dq1sq
Signed-off-by: cliffhall <cliff@futurescale.com>

.github/workflows/dependabot-alerts.yml

@@ -55,6 +55,16 @@ on:
     - cron: "17 6 * * *" # 06:17 UTC daily; alerts are not minute-sensitive
   workflow_dispatch:
 
+# The marker check is a read-before-write, not an atomic one, and nothing stops
+# a `workflow_dispatch` from landing on top of the scheduled run. Two overlapping
+# runs would both see no open issue and both file one, which is the exact
+# duplicate this sweep's whole idempotency design exists to prevent (Copilot).
+# `cancel-in-progress: false` because the queued run must WAIT and then re-read
+# the state the first run wrote — cancelling it would drop a sweep instead.
+concurrency:
+  group: dependabot-alert-sweep
+  cancel-in-progress: false
+
 permissions:
   contents: read
   issues: write