fix(ci): repair workflows that are not valid YAML and have never run (#76)

**These workflow files are not valid YAML, so they have never run.** Not
"ran and failed" — never ran. GitHub Actions rejects the file before
creating any job: the run is recorded as `failure` with **no jobs, no
log and no check run**, and `gh pr checks` shows no row at all. A red
mark with nothing behind it to read.

## Cause

A sweep added permission declarations **by line position rather than by
parsing the document**. Three invalid shapes resulted:

**A — a mapping indented under a scalar value**
```yaml
permissions: read-all
  actions: read        # read-all is a SCALAR; it cannot take children
```
`read-all` already grants everything `actions: read` would, so the
orphaned line is dropped and nothing is lost.

**B — injected inside another block**
```yaml
on:
  permissions: contents: read     # two colons, and illegal under `on:` anyway
  push:
```

**C — a literal `\n` that was never interpreted**, gluing the escape's
`n` to the key:
```yaml
    runs-on: ubuntu-latest
npermissions:                     # "\npermissions:" written literally
```
Only a text-level writer emitting an uninterpreted escape can produce
that.

## Verified, not assumed

Every workflow in this repository parses after the change. The repairer
**refuses to write any file that does not parse and still contain jobs**
afterwards.

Where a job-level `permissions:` line was removed, a **read-only
top-level `permissions:` remains**, so nothing is widened — and if none
would remain, the tool reports that rather than inventing one. Guessing
a permission set is how you silently over-grant.

## Estate context

**67 repositories and 100 workflow files are in this state.** The most
frequently broken file is **`workflow-linter.yml`, in 22 repositories**
— followed by `scorecard.yml` (20) and `dogfood-gate.yml` (13).

The workflow whose job is to lint workflows was itself unparseable, so
**it never ran, and never caught this or anything else.** The check that
would have found the damage was destroyed by the same sweep that caused
it.

## So it cannot recur invisibly

Detection is being added upstream: a strict-YAML check in the governance
reusable — hyperpolymath/standards#582. Ordinary validation cannot see
this class of fault, because `yaml.safe_load` silently accepts duplicate
keys and only a full parse catches the malformed indentation.

## Expect this repository to get louder

Workflows that have been failing silently will now actually run, and
some will find real problems that have been invisible for as long as the
files have been broken.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/dogfood-gate.yml

@@ -264,26 +264,26 @@ jobs:
 
           # Validate TOML structure using Python 3.11+ tomllib
           python3 -c "
-import tomllib, sys
-with open('eclexiaiser.toml', 'rb') as f:
-    data = tomllib.load(f)
-project = data.get('project', {})
-if not project.get('name', '').strip():
-    print('ERROR: project.name is required', file=sys.stderr)
-    sys.exit(1)
-functions = data.get('functions', [])
-if not functions:
-    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)
-    sys.exit(1)
-for fn in functions:
-    if not fn.get('name', '').strip():
-        print('ERROR: function name cannot be empty', file=sys.stderr)
-        sys.exit(1)
-    if not fn.get('source', '').strip():
-        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)
-        sys.exit(1)
-print(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')
-" || {
+          import tomllib, sys
+          with open('eclexiaiser.toml', 'rb') as f:
+              data = tomllib.load(f)
+          project = data.get('project', {})
+          if not project.get('name', '').strip():
+              print('ERROR: project.name is required', file=sys.stderr)
+              sys.exit(1)
+          functions = data.get('functions', [])
+          if not functions:
+              print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)
+              sys.exit(1)
+          for fn in functions:
+              if not fn.get('name', '').strip():
+                  print('ERROR: function name cannot be empty', file=sys.stderr)
+                  sys.exit(1)
+              if not fn.get('source', '').strip():
+                  print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)
+                  sys.exit(1)
+          print(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')
+          " || {
             echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"
             exit 1
           }

.github/workflows/scorecard.yml

@@ -9,7 +9,6 @@ on:
     branches: [main]
 
 permissions: read-all
-  actions: read
 
 jobs:
   analysis: