ci: add scorecard/mirror/secret-scanner; timeout-minutes on casket-pages

Addresses the Hypatia workflow-audit findings on PR #23 (all pre-existing;
none introduced by the docs pass).

(b) Add the three missing estate-standard workflows, copied from the canonical
    sibling form (SHA-pinned standards reusables):
    - mirror.yml          (mirror-reusable @e6b2884)
    - secret-scanner.yml  (secret-scanner-reusable @3e4bd4c)
    - scorecard.yml       (scorecard-reusable @e036864; workflow-level
      contents:read + job-level security-events/id-token writes — the
      known-good form that avoids the estate-wide read-all startup_failure)

(a) Add timeout-minutes: 10 to casket-pages.yml build + deploy jobs.

The remaining missing_timeout_minutes findings (governance/hypatia-scan/
rust-ci) are NOT fixable here: those jobs call reusables via `uses:`, where
timeout-minutes is not a legal job key — it must live in the standards
reusables (out of scope). Recorded in agent_instructions/debt.a2ml, along
with the intentionally-left unpinned governance@main.

https://claude.ai/code/session_01JNCDaWMB8NV6nAPrvmTg4w

Author: hyperpolymath

.github/workflows/casket-pages.yml

@@ -18,6 +18,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
@@ -36,6 +37,7 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     needs: build
+    timeout-minutes: 10
     steps:
       - name: Deploy to GitHub Pages
         id: deployment

.github/workflows/mirror.yml

@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Mirror to Git Forges
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  mirror:
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f
+    secrets: inherit

.github/workflows/scorecard.yml

@@ -0,0 +1,26 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Scorecards supply-chain security
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '23 4 * * 1'
+  push:
+    branches: [main]
+
+# Workflow-level permissions are read-only. The job that calls the reusable
+# upgrades to the writes `ossf/scorecard-action` requires. Job-level
+# permissions REPLACE workflow-level for that job, so `contents: read` here
+# plus the writes below yields the correct effective set and avoids the
+# `read-all` startup_failure seen estate-wide. Matches the canonical caller in
+# hyperpolymath/standards/.github/workflows/scorecard-reusable.yml.
+permissions:
+  contents: read
+
+jobs:
+  analysis:
+    permissions:
+      security-events: write
+      id-token: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e03686486e11b662834d7090dffae54c3e96fd59
+    secrets: inherit

.github/workflows/secret-scanner.yml

@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Secret Scanner
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0
+    secrets: inherit

.machine_readable/agent_instructions/debt.a2ml

@@ -77,3 +77,17 @@ issue = "DUST section references contractiles/dust/Dustfile.a2ml which does not
 effort = "easy"
 impact = "low"
 discovered = "2026-06-03"
+
+[[debt.could]]
+component = ".github/workflows (reusable-caller wrappers)"
+issue = "Hypatia flags missing_timeout_minutes on governance.yml/hypatia-scan.yml/rust-ci.yml, but these are reusable-callers (uses:) where timeout-minutes is not a legal job key — the timeout must be set inside the hyperpolymath/standards reusables (out of this repo's scope). casket-pages.yml (real steps) was fixed in PR #23."
+effort = "medium"
+impact = "low"
+discovered = "2026-06-03"
+
+[[debt.could]]
+component = "governance.yml"
+issue = "Hypatia flags unpinned_action: governance-reusable.yml@main is floated on @main not a SHA. Left intentionally (maintainer: estate may want first-party reusables to auto-update); revisit if the estate standardises on SHA-pinned reusables."
+effort = "easy"
+impact = "low"
+discovered = "2026-06-03"