ci(scorecard): add job-level permissions for reusable workflow

[hyperpolymath]

Summary

Adds the job-level permissions: { security-events: write, id-token: write } block to the analysis job in .github/workflows/scorecard.yml, fixing the silent startup_failure on every Scorecard run.

Why

scorecard-reusable.yml's docstring states:

Caller MUST grant security-events: write and id-token: write on the calling job. The reusable re-asserts these on its own analysis job, but called-workflow permissions are CAPPED by the caller's permissions block.

Without this, ossf/scorecard-action cannot upload SARIF, the workflow fails at startup, and there are no logs.

Sweep

Part of estate-wide sweep tracked at hyperpolymath/standards#282. Pattern shipped in julia-professional-registry#19 (2026-05-27) and absolute-zero#68 (2026-05-30).

Test plan

• Next Scorecard run completes successfully (cron '23 4 * * 1')
• SARIF appears in Security tab
• No startup_failure runs after merge

Refs hyperpolymath/standards#282

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 212 issues detected

Severity	Count
🔴 Critical	17
🟠 High	123
🟡 Medium	72

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stale AI session file -- delete",
    "type": "stale",
    "file": "GEMINI.md",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Action    if: always()\n        uses: actions/upload-artifact@ea165 needs attention",
    "type": "unpinned_action",
    "file": "e2e.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in abi-drift.yml",
    "type": "unknown",
    "file": "abi-drift.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "unknown",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in container-publish.yml",
    "type": "unknown",
    "file": "container-publish.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence