fix(ci): migrate existing agentic workflows to gh-aw v0.61.0 schema

[DimaBir]

Summary

• Moves roles from top-level to on.roles for CI Doctor and Issue Assistant
• Renames fetch.allowed-domains to fetch.allowed (schema change)
• Recompiles both lock files with gh-aw v0.61.0, all actions SHA-pinned

Why

gh-aw schema changed between v0.43.23 and v0.61.0. Old lock files still work
but recompilation fails on new schema. Discovered during breach monitor workflow work.

Note: v0.62.5 was skipped because its Windows binary is broken (hangs on every invocation including --help). v0.61.0 accepts the same schema and compiles cleanly.

Test plan

• Both workflows compile with gh aw compile (0 errors, 0 warnings)
• CI Doctor still triggers on CI failures
• Issue Assistant still triggers on new issues