fix(ci): secret-scanner callers must grant the reusable's job permissions (#472)

Root cause of the estate-wide Secret Scanner `startup_failure`
(including on this repo's own main): the reusable's gitleaks job
requests `pull-requests: write` + `actions: read` (added for PR summary
comments, .git-private-farm#69), but a called workflow cannot exceed the
caller's grant. Every wrapper granting only `contents: read` — which is
exactly what the reusable's own documented caller example says to do —
dies at startup: *"the workflow is requesting 'pull-requests: write',
but is only allowed 'pull-requests: none'"*. This is why the failure
persisted across every pin bump: the bug is in the caller shape, not the
pinned ref.

- Header caller example now grants the permissions at the calling job
(same consumption pattern as the scorecard reusable) — this is the shape
wrapper sweeps copy.
- This repo's own wrapper: grant the permissions and bump the pin off
known-bad `d135b05` to current main (`891b1ed`).

Estate note: the ~281 repo wrappers need the same job-level grant on
their next sweep; the grant is safe at any pinned ref (refs that don't
request the elevation simply downgrade). Proven fix live on
somethings-fishy PR #51.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/secret-scanner-reusable.yml

@@ -35,7 +35,13 @@
 #     the read-only cancel-superseded behaviour stays in the wrapper.
 #   - Trufflehog removed: gitleaks provides sufficient coverage at lower cost.
 #
-# Caller example (wrapper):
+# Caller example (wrapper). NOTE the job-level permissions grant: the
+# gitleaks job below requests `pull-requests: write` + `actions: read`,
+# and a called workflow cannot exceed the caller's grant — a wrapper
+# that grants only `contents: read` dies at startup_failure on every
+# run ("requesting 'pull-requests: write', but is only allowed
+# 'pull-requests: none'"). Same consumption pattern as the scorecard
+# reusable.
 #   # SPDX-License-Identifier: MPL-2.0
 #   name: Secret Scanner
 #   on:
@@ -49,6 +55,10 @@
 #     contents: read
 #   jobs:
 #     scan:
+#       permissions:
+#         contents: read
+#         pull-requests: write
+#         actions: read
 #       uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@<sha>
 #       secrets: inherit
 

.github/workflows/secret-scanner.yml

@@ -15,5 +15,13 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    # The reusable's gitleaks job requests pull-requests: write (PR
+    # summary comments, .git-private-farm#69) and actions: read. A
+    # called workflow cannot exceed the caller's grant — without these
+    # here every run dies at startup_failure.
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@891b1ed6164478616cb3375f328c6487ccb13f80
     secrets: inherit