fix(ci): grant actions: read so the bumped reusable can start

The governance-reusable at standards HEAD requests `actions: read`. A caller
granting only `contents: read` fails at startup after the pin bump, reporting
no check at all. This grants the missing scope in the same PR as the bump.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance.yml

@@ -27,6 +27,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs: