fix(ci): make OSSF Scorecard caller valid (perms / drop timeout-minut… #45

Job	Run time
governance / Well-Known (RFC 9116 + RSR)	6s
governance / Security policy checks	4s
governance / Licence consistency	8s
governance / Code quality + docs	15s
governance / Guix primary / Nix fallback policy	5s
governance / Language / package anti-pattern policy	13s
governance / Workflow security linter	5s
governance / Trusted-base reduction policy	9s
governance / Check Workflow Staleness	6s
governance / Validate Hypatia Baseline	0s
	1m 11s

Provide feedback