Harden Project intake token and quota handling

[codeforester]

Problem

The Project intake workflow depends on BASE_PROJECT_TOKEN for org Project writes, but the workflow currently falls back to github.token. That fallback can make failures look like ordinary intake drift when the real problem is missing Project-write credentials.

Bulk manual backfills can also exhaust GitHub GraphQL quota, which leaves older issues absent from the Project until someone notices and retries.

Acceptance criteria

• project-intake.yml fails early with a clear error when BASE_PROJECT_TOKEN is not configured.
• The workflow checks GraphQL quota before Project mutations and reports the reset time when the remaining budget is too low.
• The repo documents a safe throttled backfill command for reconciling missed issues.
• Validation covers the workflow guard and backfill guidance.