sweep: drop the legacy WEBHOOK_TOKEN fallback (cutover is complete)

ADMIN_TOKEN_LEGACY is "0" and verified: ADMIN_TOKEN returns 200 on /admin/*,
WEBHOOK_TOKEN returns 403. The fallback in sweep.sh would therefore turn
"ADMIN_TOKEN unset" into a confusing mid-run 403 rather than the clear abort
that already exists three lines below it. Same removal in the digest script.

Not a behaviour change in normal operation — ADMIN_TOKEN is set (len 64) and
already preferred — but it removes a foot-gun that could mask a broken
configuration, and leaves the code honest about which credential is live.

sweep.sh

@@ -7,16 +7,17 @@
 #
 # The ADMIN_TOKEN env var is shared with the main app (scheduler runs in the
 # same launch environment), so we use it to authenticate the call. Admin auth is
-# a header, never a URL token (security fix 2026-10-27). WEBHOOK_TOKEN is only a
+# a header, never a URL token (security fix 2026-10-27). The WEBHOOK_TOKEN
-# fallback until this caller is fully migrated.
+# fallback was removed when the cutover completed (ADMIN_TOKEN_LEGACY=0): the
+# legacy token now gets 403 on /admin/*, so falling back to it would turn
+# "ADMIN_TOKEN unset" into a confusing mid-run 403 instead of a clear abort.
 #
 # Uses Python (guaranteed present in the base image) rather than curl.
 
 set -e
 
-ADMIN_TOKEN="${ADMIN_TOKEN:-$WEBHOOK_TOKEN}"
 if [ -z "$ADMIN_TOKEN" ]; then
-  echo "sweep: neither ADMIN_TOKEN nor WEBHOOK_TOKEN is set; aborting" >&2
+  echo "sweep: ADMIN_TOKEN is not set; aborting" >&2
   exit 1
 fi