fix(ci): close the governance gate — SPDX, permissions, SHA pins, reusable bump

[hyperpolymath]

The governance gate is all-jobs-must-pass, so these ship as one commit;
individually none of them turns the repo green.

• SPDX line-1 header and a top-level permissions: block on every
  workflow file (the two Workflow security linter checks).
• Every uses: tag reference resolved to a full 40-hex commit SHA. This
  satisfies the linter and also the repository's own
  sha_pinning_required Actions policy, which refuses @v4 at parse
  time — a refusal that produces no check run at all.
• hypatia-scan.yml now grants security-events: write. This is not
  cosmetic and is not separable from the pin bump below: at HEAD the
  reusable declares security-events: write where the old pin declared
  read, and a called workflow cannot escalate beyond its caller's
  grant. Bumping the pin without this would fail at parse time.
• The three reusables watched by the staleness gate (governance,
  hypatia-scan, scorecard) advanced to standards HEAD, which is 62
  commits ahead of the false-green cache fix and includes the
  deny-list-negative fix from standards#524.

mirror-reusable and secret-scanner-reusable are deliberately left on
their current pins: the staleness gate does not watch them, so they are
not holding anything red, and bumping them carries unrelated risk.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/hyperpolymath/standards/.github/workflows/scorecard-reusable.yml	81dbf2dd854b1444fd6236fa2352474383b2c2b9	🟢 6	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 30 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 0/26 approved changesets -- score normalized to 0 Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 7 binaries present in source code CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 SAST 🟢 10 SAST tool is run on all commits Signed-Releases ⚠️ -1 no releases found Vulnerabilities ⚠️ 0 11 existing vulnerabilities detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6 CI-Tests 🟢 10 28 out of 28 merged PRs checked by a CI test -- score normalized to 10

Scanned Files

• .github/workflows/scorecard.yml