fix(bitacora): drive Projects v2 via github-script (gh project → unknown owner type)

[mlorentedev]

Problem

bitacora-status.yml (HARNESS-010, #286) failed at runtime on the first real assignment: gh project item-add --owner mlorentedev errors with unknown owner type. The gh project CLI cannot resolve the owner under the fine-grained BITACORA_PAT, even though that PAT has project write (the add-to-project action works because it uses raw GraphQL, not gh project).

A live end-to-end test (assigning a throwaway issue) surfaced this — CI was green because the failure only happens at runtime with the real secret.

Fix

Rewrite the status step with actions/github-script@v9, calling the Projects v2 GraphQL directly:

• addProjectV2ItemById (idempotent — returns the existing item id) keyed off context.payload.issue.node_id;
• updateProjectV2ItemFieldValue to set Status = In Progress.

No gh project, no shell-quoting of GraphQL, no lint suppressions. Runbook §7b template updated to match.

Verification

• actionlint → exit 0; YAML valid; spec-gate → OK (36 LOC, under threshold).
• The exact two mutations were run against the live board before shipping (added + flipped a real issue to In Progress, idempotent re-add confirmed).
• Post-merge: a fresh assign-a-throwaway-issue test will confirm the deployed workflow goes green and flips the field.

Follow-up to #286 (HARNESS-010).