ci: auth private git deps for Dependabot (REPORTLAB_READ_PAT)

[wtthornton]

Summary

• Adds a guarded "Auth private git deps" step to the quality and agent-contract jobs in .github/workflows/tapps-quality.yml, run after Checkout and before Set up uv.
• Only runs when REPORTLAB_READ_PAT is non-empty, so normal pull_request runs (where Dependabot secrets aren't exposed) are unaffected.
• Fixes Dependabot PRs chore(deps-dev): update pytest requirement from <10,>=9.0.3 to >=9.1.1,<10 #169/chore(deps-dev): update ruff requirement from <1,>=0.15.16 to >=0.15.20,<1 #170 failing uv sync on the private wtthornton/ReportLab (nlt-report-studio) dependency.

Test plan

• YAML syntax validated (python3 -c "import yaml; yaml.safe_load(...)")
• CI green on this PR (workflow-only change)