fix(janitor): add cortextos+conduit to dependabot-janitor repo scope

[asachs01]

dependabot-janitor.sh's repo-scope regex only matches -mcp$|^mcp|^node- — cortextos and conduit never match, so their own Dependabot PRs get zero auto-merge coverage today. agent-merge-janitor deliberately excludes any package.json/lockfile touch by design (confirmed with boss+warden 2026-08-02), so this is the correct home for that traffic, not a gap in the newer janitor.

Added by exact repo name (^cortextos$|^conduit$) rather than widening the existing pattern, since neither repo shares the mcp-server shape this script was built around.

Verified the change against the script's own discovery pipeline before opening this PR — both repos now appear in the resulting REPOS array.

Note: the Dependabot Janitor workflow is currently disabled_manually (unrelated — pending the .github CI-split precondition, task_1786765529531). This change has zero live effect until that lands and the workflow is re-enabled. Not urgent, opened now so it's ready.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[asachs01]

Automated review (forge):

Reviewed the diff (.github/scripts/dependabot-janitor.sh, +7/-2) against current main.

Correctness: straightforward and correct. Adds ^cortextos$|^conduit$ as exact-name alternatives in the existing scope regex, rather than widening the -mcp$|^mcp|^node- pattern to cover these two repos — the right call since neither shares the mcp-server shape the pattern was built around. Confirmed the comment's rationale (agent-merge-janitor deliberately excludes package.json/lockfile touches) is consistent with how the janitor scripts are described in the related PRs (#51/#54/#55). No behavior change to any repo currently matched by the existing pattern.

Live effect: correctly scoped as inert today — dependabot-janitor is disabled_manually, so this has zero runtime effect until it's re-enabled (tracked separately per the PR body).

CI: actionlint green, no other checks relevant to a shell-only change.

Collision risk: this PR, #54, and #55 all modify .github/scripts/dependabot-janitor.sh starting from the same base blob (5b5f512), in different regions of the file (this one touches the REPOS discovery grep near the top; #54 touches classify(); #55 touches the merge call near the bottom). That's why #50 and #54 currently show CONFLICTING/DIRTY against current main while #55 is still MERGEABLE/CLEAN — not a dependency ordering issue, just same-file edit collision. Whichever of the three merges first will very likely knock the other two into CONFLICTING and they'll need a rebase (conflicts should be mechanical/non-overlapping given the different regions touched).

Verdict: safe to merge as written, pending Aaron's go-ahead and the rebase that'll be needed depending on merge order with #54/#55.