chore(deps): address Copilot review round 5 on #2243

Both findings were "previously missed" suppressed ones; the two against
scripts/dependency-refresh.mjs and its workflow are relayed to #2239.

- Serialize the sweep with a fixed concurrency group and
  cancel-in-progress: false. The marker check is a read-before-write and
  a workflow_dispatch can land on top of the scheduled run, so two runs
  could both see no open issue and both file one — the duplicate the
  whole idempotency design exists to prevent. The queued run must wait
  and re-read, never be cancelled.
- Pick the milestone in JS, not in jq. jq sorts null before every
  string, so sort_by(.due_on) | .[0] returns an UNDATED open milestone
  in preference to every dated one. An undated bucket has no due date
  and so cannot be the nearest; pickMilestone drops it, and files the
  issue unmilestoned if nothing dated is open.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013H6Cew3KB3jVmQ5x4Dq1sq
Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/dependabot-alerts.mjs

@@ -308,6 +308,27 @@ export function groupAlerts(alerts) {
     );
 }
 
+/**
+ * The milestone a new issue takes: the open one with the NEAREST due date.
+ *
+ * ⚠️ Selected here rather than in a `jq` expression because jq sorts `null`
+ * BEFORE every string, so a `sort_by(.due_on) | .[0]` over the raw list hands
+ * back an undated milestone in preference to every dated one (Copilot). An
+ * undated bucket has no due date and so cannot be the nearest; it is dropped
+ * rather than sorted last, and if nothing dated is open the issue is filed
+ * unmilestoned and triage places it.
+ *
+ * @param {Array<{title: string, state?: string, due_on?: string | null}>} milestones
+ * @returns {string | null}
+ */
+export function pickMilestone(milestones) {
+  const dated = (milestones ?? []).filter(
+    (m) => (m.state ?? "open") === "open" && m.due_on,
+  );
+  if (dated.length === 0) return null;
+  return dated.sort((a, b) => a.due_on.localeCompare(b.due_on))[0].title;
+}
+
 /**
  * Narrow a group to the advisories that actually apply to what is installed.
  *
@@ -683,16 +704,11 @@ function announcedAdvisories(repo, number, spawn) {
 }
 
 function currentMilestone(repo, spawn) {
-  const result = gh(spawn, [
-    "api",
-    `repos/${repo}/milestones`,
-    "--jq",
-    'map(select(.state=="open")) | sort_by(.due_on) | .[0].title // empty',
-  ]);
+  const result = gh(spawn, ["api", `repos/${repo}/milestones?state=open`]);
   if (result.status !== 0) {
     throw new Error(`milestone lookup failed: ${(result.stderr ?? "").trim()}`);
   }
-  return result.stdout.trim() || null;
+  return pickMilestone(JSON.parse(result.stdout || "[]"));
 }
 
 /**