[codex] Document torch Dependabot alert governance

[EigenCharlie]

What changed

• Documents the post-merge Dependabot feat(intake): parent state-of-the-art + competing-risks/CIF + MRM SR 11-7 deep-dive #13 finding for torch / torch.jit.script in docs/refactor/NEXT_WORK_PLAN_2026-06.md.
• Records why no dependency change is appropriate today: torch is limited to optional spo, the repo does not use TorchScript, and the advisory has no patched version.
• Records the failed attempt to dismiss the alert due PAT permissions and the future trigger for a real dependency PR.

Validation

• git diff --check
• just lint
• just validate-champion
• push hooks: DVC status, smoke, validate champion

No protected stages, freeze, or submission actions were run.