fix(ci): grant the wrapper the permissions the reusable declares (#60)

**Every run of this wrapper was `startup_failure`** — the workflow never
started, so the repository has never published a Hypatia check. That is
the defect class of hyperpolymath/tropical-types#17: a gate (or a
requirement) that names a context nothing publishes.

Cause: the Hypatia reusable workflow declares `actions: read`,
`contents: read` and `security-events: write`, and a caller cannot start
a called workflow unless its job grants at least what the called
workflow declares. This wrapper did not grant `actions: read`.

Fix, minimal:

* grant `actions: read` (at the job level where a job-level
`permissions:` block overrides the workflow-level one);
* pass `secrets: inherit` — the reusable consumes
`secrets.HYPATIA_SCAN_PAT || secrets.GITHUB_TOKEN`.

The caller id, the pin and the rest of the job are untouched. Found by
the caller-id standardisation sweep (same probe: read the run history,
not the file).

Author: hyperpolymath

.github/workflows/hypatia-scan.yml

@@ -20,9 +20,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
   security-events: write
 
 jobs:
   hypatia:
     uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
+
+    secrets: inherit