fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Two defects, and fixing only the first would look like a cure while
changing nothing.

1. `permissions: read-all` is a SCALAR, so the indented `actions: read`
   beneath it is a mapping entry under a scalar: invalid YAML. GitHub
   never parsed the file, the run emitted zero jobs, and the Scorecard
   check never appeared. The gate was ABSENT, not red.

2. The `analysis` job declares its own `permissions:` block naming only
   `security-events` and `id-token`. A job-level block REPLACES the
   workflow-level one rather than merging with it, so the reusable
   workflow was being called without `contents: read` and could not
   check out. Deleting the orphan key alone would yield a file that
   parses and still emits no check.

Adds `contents: read` to the job block, matching aerie#76 (merged
2026-09-13), which carries exactly these three job permissions.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

Author: hyperpolymath

.github/workflows/scorecard.yml

@@ -7,11 +7,11 @@ on:
     - cron: '23 4 * * 1'
 
 permissions: read-all
-  actions: read
 
 jobs:
   analysis:
     permissions:
+      contents: read
       security-events: write
       id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3