fix(ci): grant Scorecard's called workflow contents:read (last startup_failure) (#294)

Two independent fixes, both **measured on `main`** after #293 landed.

## 1 · `Scorecards supply-chain security` — the last `startup_failure`

Re-pinning `scorecard-reusable` in #293 did **not** fix it. That is the
useful result: it proves the stale pin was never the cause.

The real cause is the caller's permission block:

```yaml
jobs:
  analysis:
    permissions:
      security-events: write
      id-token: write        # <- `contents` omitted
```

Declaring `permissions:` at **job** level sets every *unlisted* scope to
`none`, and a called workflow can never hold more than the calling job
grants it. `scorecard-reusable` declares top-level `permissions:
contents: read` and its first step is `actions/checkout` — so it was
being handed **`contents: none`**. The call died at startup with zero
jobs, which is exactly why there is no log to read and why it looked
inscrutable.

**Confirmed against the green sibling.** `boj-server-cartridges`'
`scorecard.yml` lists all three — `contents: read`, `security-events:
write`, `id-token: write` — and its runs succeed. This one omitted the
first.

This is root cause **(A)** of the estate's two `startup_failure` shapes
— *reusable permission escalation* — and is unrelated to BROKEN-M1,
which was the other.

## 2 · Revert `pages.yml` / `pages-deploy.yml` checkout to the v4 SHA

#293 pinned these to `de0fac2e` (v6.0.2). On reflection that shipped an
unvalidated version change:

- Both workflows are **`push: [main]`-only** — no `pull_request` — so no
PR can exercise them. The bump's first execution is on `main`.
- `pages.yml` is this repo's **only container job** (`idris2-pack`) and
has **never completed a run**. checkout v6 requires node24 injected into
the container; whether that works against this image is precisely what
could not be observed.

`11d5960a` is exactly what `actions/checkout@v4` resolves to today, so
this is a **pure pin** — the linter only requires a full-length SHA, not
a particular version. A considered v4 → v6 bump belongs in a change
where it can be watched.

## Verification

- 0 of 94 `uses:` unpinned (scanning **both** the bare and `- uses:`
forms — the latter is invisible to the standards linter)
- all three files parse as YAML

## State of `main` after #293

`Governance` is **SUCCESS** — all 9 jobs green, the two that were red
are fixed. Remaining red on `main`:

| Check | Cause | Fixed by |
|---|---|---|
| `Scorecards supply-chain security` | `contents: none` to the called
workflow | **this PR** |
| `deploy` (Cloudflare) | `CLOUDFLARE_API_TOKEN` /
`CLOUDFLARE_ACCOUNT_ID` **absent from repo secrets** — confirmed in the
log: *"necessary to set a CLOUDFLARE_API_TOKEN environment variable"* |
needs a human: add secrets or retire the workflow |
| `SonarQube` | `SONAR_TOKEN` exists but `HTTP 403`; the SonarCloud
project itself is fine (badge endpoint 200), so the token is
expired/wrong-scope | needs a human: regenerate in SonarCloud |

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath

.github/workflows/pages-deploy.yml

@@ -18,7 +18,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Deploy site/ to Cloudflare Workers (static assets)
         run: npx wrangler@latest deploy
         env:

.github/workflows/pages.yml

@@ -23,9 +23,9 @@ jobs:
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
       - name: Checkout Site
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Checkout Ddraig SSG
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg

.github/workflows/scorecard.yml

@@ -31,6 +31,14 @@ permissions:
 jobs:
   analysis:
     permissions:
+      # `contents: read` is REQUIRED, not redundant. Declaring `permissions:`
+      # at job level sets every unlisted scope to `none`, and a called
+      # workflow can never hold more than the calling job grants it. The
+      # reusable declares top-level `permissions: contents: read` and its
+      # first step is actions/checkout, so omitting `contents` here handed
+      # it `contents: none` and the call died at startup with zero jobs.
+      # The green sibling (boj-server-cartridges) lists all three.
+      contents: read
       security-events: write
       id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8813ecf2a841335c9dc14c75cc46694722cd6d28