fix(scorecard): enforce granular permissions and add fuzzing placeholder

Author: hyperpolymath

.github/workflows/boj-build.yml

@@ -15,4 +15,5 @@ jobs:
           # Send a secure trigger to boj-server to build this repository
           curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
         continue-on-error: true
-permissions: read-all
+permissions:
+  contents: read

.github/workflows/codeql.yml

@@ -90,4 +90,5 @@ jobs:
         uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4
         with:
           category: "/language:${{matrix.language}}"
-permissions: read-all
+permissions:
+  contents: read

.github/workflows/guix-nix-policy.yml

@@ -28,4 +28,5 @@ jobs:
           fi
 
           echo "✅ Package policy check passed"
-permissions: read-all
+permissions:
+  contents: read

.github/workflows/hpc-ci.yml

@@ -27,7 +27,8 @@ on:
       - 'generated/abi/**'
       - '.github/workflows/hpc-ci.yml'
 
-permissions: read-all
+permissions:
+  contents: read
 
 env:
   ZIG_VERSION: '0.15.2'

.github/workflows/hypatia-scan.yml

@@ -11,7 +11,8 @@ on:
     - cron: '0 0 * * 0'  # Weekly on Sunday
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   scan:

.github/workflows/mirror.yml

@@ -8,7 +8,8 @@ on:
       - 'v*'
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   mirror-gitlab:

.github/workflows/npm-bun-blocker.yml

@@ -2,7 +2,8 @@
 name: NPM/Bun Blocker
 on: [push, pull_request]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   check:

.github/workflows/quality.yml

@@ -42,4 +42,5 @@ jobs:
           else
             echo "✅ Core documentation present"
           fi
-permissions: read-all
+permissions:
+  contents: read

.github/workflows/rsr-antipattern.yml

@@ -72,4 +72,5 @@ jobs:
           echo "║                                                            ║"
           echo "║  Blocked: TypeScript, Go, npm, Python (non-Salt)          ║"
           echo "╚════════════════════════════════════════════════════════════╝"
-permissions: read-all
+permissions:
+  contents: read

.github/workflows/scorecard-enforcer.yml

@@ -9,7 +9,8 @@ on:
     - cron: '0 6 * * 1'  # Weekly on Monday
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   scorecard: