ci: adopt standards reusable workflows for Scorecard, Hypatia, and Governance

Author: hyperpolymath

.github/workflows/governance.yml

@@ -1,24 +1,16 @@
-# SPDX-License-Identifier: MPL-2.0
-# governance.yml — single wrapper calling the shared estate governance bundle
-# in hyperpolymath/standards. Replaces ~8 duplicated per-repo governance
-# workflows (verisimiser#59 estate rollout). Load-bearing build/security
-# workflows (rust-ci, codeql, dependabot, release, secret-scanner, scorecard)
-# stay standalone in this repo.
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Governance
+
 on:
   push:
     branches: [main, master]
   pull_request:
+    branches: [main, master]
   workflow_dispatch:
-# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
-# updates do not pile up queued runs against the shared account-wide
-# Actions concurrency pool. Applied only to read-only check workflows
-# (no publish/mutation), so cancelling a superseded run is always safe.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+
 permissions:
   contents: read
+
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995

.github/workflows/hypatia-scan.yml

@@ -1,8 +1,6 @@
-# SPDX-License-Identifier: MPL-2.0
-# Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml.
-# See standards#191 for the reusable's purpose and design.
-
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Hypatia Security Scan
+
 on:
   push:
     branches: [main, master, develop]
@@ -11,15 +9,11 @@ on:
   schedule:
     - cron: '0 0 * * 0'
   workflow_dispatch:
-# Estate guardrail: cancel superseded runs so re-pushes don't pile up.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+
 permissions:
   contents: read
-  security-events: write
-  pull-requests: write
+  security-events: read
+
 jobs:
-  hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5eb28d7d8790d5389b7b6a5233fe6265a775e3d0
-    secrets: inherit
+  scan:
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995

.github/workflows/scorecard-enforcer.yml

@@ -1,28 +1,16 @@
-# SPDX-License-Identifier: MPL-2.0
-name: Scorecards supply-chain security
+# SPDX-License-Identifier: PMPL-1.0-or-later
+name: OSSF Scorecard
+
 on:
-  branch_protection_rule:
-  schedule:
-    - cron: '23 4 * * 1'
   push:
-    branches: [main]
-# Workflow-level permissions are read-only. The job that calls the
-# reusable upgrades to the writes required by `ossf/scorecard-action`.
-# Job-level permissions REPLACE workflow-level for the job, so a bare
-# `permissions: read-all` at workflow level + writes at job level is
-# equivalent to `contents: read` at workflow level — both yield the
-# same effective set at the job. We match the canonical caller in
-# `hyperpolymath/standards/.github/workflows/scorecard-reusable.yml`
-# (and the known-good sibling julia-professional-registry/scorecard.yml)
-# to eliminate the prior `read-all` / `contents: read` divergence as a
-# possible cause of the persistent `startup_failure` (every run since
-# adoption — see PR #457's test-plan delta).
+    branches: [main, master]
+  schedule:
+    - cron: '0 4 * * *'
+  workflow_dispatch:
+
 permissions:
   contents: read
+
 jobs:
-  analysis:
-    permissions:
-      security-events: write
-      id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e03686486e11b662834d7090dffae54c3e96fd59
-    secrets: inherit
+  scorecard:
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995