chore(ci): assign closed items to sprints (NVIDIA#3216)

## Summary
Adds a metadata-only GitHub Actions workflow that assigns closed issues
and pull requests to the NemoClaw Development Tracker Sprint field when
they do not already have one. The workflow uses GitHub App
authentication and direct ProjectV2 GraphQL mutations so closed work
stays represented in sprint reporting.

## Changes
- Adds `.github/workflows/assign-closed-items-to-sprint.yaml` for closed
issue/PR events, hourly reconciliation, and manual dry-run
reconciliation.
- Uses a pinned `actions/create-github-app-token` action with
organization project permissions instead of `actions/add-to-project` or
a PAT.
- Adds a static workflow test that checks triggers, permissions, no
checkout, no title/body shell interpolation, and embedded shell syntax.

## Type of Change
- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Verification
- [ ] `npx prek run --all-files` passes
- [ ] `npm test` passes
- [x] Tests added or updated for new or changed behavior
- [x] No secrets, API keys, or credentials committed
- [ ] Docs updated for user-facing behavior changes
- [ ] `make docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

Additional validation:
- `npx vitest run --project cli
test/assign-closed-items-to-sprint-workflow.test.ts` passes.
- `npm run typecheck:cli` passes.
- Read-only dry run selected `Sprint 4 - Spark Joy` for a closed PR
missing Sprint.
- Read-only dry run reported it would add a closed PR missing from
project NVIDIA#199 and assign `Sprint 4 - Spark Joy`.

Skipped/failed local checks:
- `npx prek run --all-files` stopped at `hadolint` because `hadolint` is
not installed in this environment; earlier hook steps passed through
Biome lint fixes.
- `npm test` was attempted after rebuilding root CLI and nested plugin
artifacts, but still failed on unrelated local/environment-sensitive
tests: plugin/package artifact setup, installer integration timeouts,
and existing numeric env validation expectations.

---
<!-- DCO sign-off required by CI. Run: git config user.name && git
config user.email -->
Signed-off-by: Will Curran <wcurran@nvidia.com>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Automated workflow assigns closed Issues and Pull Requests to Sprint
iterations in ProjectV2
  * Manual dispatch with configurable lookback period and dry-run mode
  * Automatic triggers on item closure and scheduled intervals

* **Tests**
* Added test suite validating workflow configuration and safety
constraints

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Will Curran <wcurran@nvidia.com>

Author: wscurran