fix(ci): wrapper permission union + standards re-pin to bd0df9e (post-lockfile follow-up) (#40)

The lockfile PR merged before this branch's final commits. This carries
the remainder: reusable wrappers granted the permission union their
reusables demand at standards >= fcb8669 (actions: read; hypatia adds
security-events: write; scorecard adds id-token + security-events: write
— a reusable requesting more than its caller grants is a
startup_failure), and the standards re-pin bumped to bd0df9e
(lockfile-aware governance lint via standards#574).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/actions.lock

@@ -20,9 +20,15 @@ workflows:
     '.github/workflows/push-email-notify.yml':
         - 'dawidd6/action-send-mail@v3.12.0'
     '.github/workflows/secret-scanner.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/checkout@v4.4.0'
         - 'trufflesecurity/trufflehog@main'
 dependencies:
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
     'actions/cache@v4.3.0':
         ref: 'v4.3.0'
         commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830'

.github/workflows/governance.yml

@@ -10,8 +10,9 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4

.github/workflows/hypatia-scan.yml

@@ -12,10 +12,12 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   security-events: read
+  security-events: write
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4
-    secrets: inherit
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    secrets: inherit

.github/workflows/mirror.yml

@@ -6,8 +6,9 @@ on:
     branches: [main]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
     secrets: inherit

.github/workflows/secret-scanner.yml

@@ -12,7 +12,7 @@ permissions:
   contents: read
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
     secrets: inherit
   trufflehog:
     runs-on: ubuntu-latest