chore: CI/CD permissions refinement, FFI wrappers, corpus expansion tooling

Refine workflow permissions from read-all to granular contents:read across
all 21 CI/CD workflows. Add FFI wrapper modules and integration test for
GraphQL/gRPC/REST interfaces. Expand training corpus with Metamath, CoqGym,
and mathlib4 extraction scripts (Julia + Python tooling). Add algebra proof
examples for Coq, Isabelle, and Lean. Update .gitignore for external corpora
and large intermediate training artifacts.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/boj-build.yml

@@ -15,4 +15,5 @@ jobs:
           # Send a secure trigger to boj-server to build this repository
           curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
         continue-on-error: true
-permissions: read-all
+permissions:
+  contents: read

.github/workflows/cflite_batch.yml

@@ -5,7 +5,8 @@ on:
     - cron: '0 3 * * 0'
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   BatchFuzzing:

.github/workflows/cflite_pr.yml

@@ -4,7 +4,8 @@ on:
   pull_request:
     branches: [main]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   PR:

.github/workflows/codeql.yml

@@ -9,7 +9,8 @@ on:
   schedule:
     - cron: '0 6 * * 1'
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analyze:

.github/workflows/generator-generic-ossf-slsa3-publish.yml

@@ -11,7 +11,8 @@
 # The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier.
 # For more information about SLSA and how it improves the supply-chain, visit slsa.dev.
 
-permissions: read-all
+permissions:
+  contents: read
 
 name: SLSA generic generator
 on:

.github/workflows/ghcr-publish.yml

@@ -1,7 +1,8 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
 name: Publish to GHCR
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   release:

.github/workflows/guix-nix-policy.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: Guix/Nix Package Policy
 on: [push, pull_request]

.github/workflows/hypatia-scan.yml

@@ -11,7 +11,8 @@ on:
     - cron: '0 0 * * 0'  # Weekly on Sunday
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   scan:

.github/workflows/mirror.yml

@@ -7,7 +7,8 @@ on:
     branches: [main]
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   mirror-gitlab:

.github/workflows/mvp-smoke.yml

@@ -7,7 +7,8 @@ on:
   pull_request:
     branches: [main]
 
-permissions: read-all
+permissions:
+  contents: read
 
 env:
   CARGO_TERM_COLOR: always