Timeout alerts and agent-run-incident alerts ignore the ADMIN_ALERT_TOKEN gate, so rows pile up undrained when no token is set #950

What

Found by the single-seat Opus review of #941 (work of #935), finding listed in #935 (comment). Finding 6. The alerts table rows written by timeout-reporter.ts and run-incident.ts are written whether or not the drain endpoint is enabled by ADMIN_ALERT_TOKEN. Without the token nothing drains them. Skip writing, or say once in the log that alerts are not drained.

Why (motivation)

A queue that nothing consumes only grows.

User impact

The owner running a stage or development bot without the token ends up with a database that grows with rows nobody will ever read, and the owner is not told.

Cost of inaction

Unbounded growth of the alerts table on hosts without the token.

Acceptance criteria

• Test: without ADMIN_ALERT_TOKEN neither reporter inserts rows
• Test: without ADMIN_ALERT_TOKEN one log line says the alerts are not drained

Screenshots

(none)

Deploy

Deployed: no

Links

• (none)

Skipped gates

• duplicate: searched incident, alert, watcher, validator, timeout, receipt; no ticket covers this
• screenshots: no UI change