Repair Scorecard CI and prevent security scan false positives (#122)

Fix the Scorecard workflow’s invalid permissions structure and grant its
caller job the actions, contents, security-events, and id-token access
it requires. Generate synthetic API-token fixtures to avoid
secret-scanner false positives, and document inert unsafe-function
scanner signatures as non-proof-debt. Validation was not run.

[View coding
task](https://app.coderabbit.ai/code/tasks/d21241c7-393c-40c4-9294-ed5a1888b167?source=coding_agent_github_pr_description)

---------

Co-authored-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Author: 3 people

docs/proof-debt.adoc

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+= Proof Debt
+
+== (a) Discharged in this repository
+
+* None.
+
+== (b) Budgeted — tested with a refutation budget
+
+* None.
+
+== (c) Necessary axioms
+
+* None.
+
+== (d) Debt — actively to be closed
+
+* None.
+
+== Scanner signatures that are not proof debt
+
+`src-gossamer/src/provenance/commands.rs` contains the strings
+`unsafePerformIO` and `unsafeCoerce` as inert signatures for PanLL's provenance
+scanner. They are data used to detect unsound constructs in inspected source;
+PanLL does not execute or invoke either escape hatch.

tests/aspect/security_test.mjs

@@ -253,20 +253,24 @@ Deno.test("Aspect/Security: AntiCrash.checkSecurityConstraints flags eval() usag
 // 5. Redaction Engine — API keys and secrets must not leave the boundary
 // ============================================================================
 
+function syntheticToken(prefix, length) {
+  return prefix + "A".repeat(length);
+}
+
 Deno.test("Aspect/Security: redactText strips Anthropic API keys (sk-ant prefix)", () => {
   const text = "My API key is sk-ant-api03-ABCDEFGHIJKLMNOPQRSTUVWXYZ";
   const result = redactText(text, builtInPatterns);
   assert(!result.includes("sk-ant-api03"), "Anthropic key prefix must be redacted");
 });
 
 Deno.test("Aspect/Security: redactText strips OpenAI API keys (sk- prefix)", () => {
-  const text = "OpenAI key: sk-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef123456";
+  const text = `OpenAI key: ${syntheticToken("sk-", 38)}`;
   const result = redactText(text, builtInPatterns);
-  assert(!result.includes("sk-ABCDEFGHIJK"), "OpenAI key must be redacted");
+  assert(!result.includes(syntheticToken("sk-", 11)), "OpenAI key must be redacted");
 });
 
 Deno.test("Aspect/Security: redactText strips GitHub tokens (ghp_ prefix)", () => {
-  const text = "GitHub token: ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ12345";
+  const text = `GitHub token: ${syntheticToken("ghp_", 35)}`;
   const result = redactText(text, builtInPatterns);
   assert(!result.includes("ghp_"), "GitHub token must be redacted");
 });