fix(ci): bump erlef/setup-beam SHA for ubuntu24 runner support (#60)

**hypatia-scan.yml**: bumps `erlef/setup-beam` SHA from `2f0cc07b…` to
`fc68ffb9…` so `ImageOS=ubuntu24` resolves to `ubuntu-24.04` (matches
the pin in hyperpolymath/hypatia upstream).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath

.github/workflows/hypatia-scan.yml

@@ -26,7 +26,7 @@ jobs:
           fetch-depth: 0  # Full history for better pattern analysis
 
       - name: Setup Elixir for Hypatia scanner
-        uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2
+        uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.18.2
         with:
           elixir-version: '1.19.4'
           otp-version: '28.3'

.github/workflows/rsr-antipattern.yml

@@ -5,9 +5,6 @@
 # Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm
 # Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme
 
-permissions:
-  contents: read
-
 name: RSR Anti-Pattern Check
 
 on:
@@ -16,11 +13,17 @@ on:
   pull_request:
     branches: [main, master, develop]
 
+
+permissions:
+  contents: read
+
 jobs:
   antipattern-check:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check for TypeScript
         run: |