Chore/hypatia scan reusable wrapper (#14)

* chore(ci): convert hypatia-scan.yml to thin wrapper of standards reusable

Replaces ~416 lines of duplicated Hypatia scan plumbing with a 29-line
wrapper calling hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml
at SHA 2569c10e831e293f9dd6580d82a494aca039deee (standards#191 HEAD).

Behaviour-preserving: same triggers, same concurrency group, same
permissions, same secrets passthrough.

Refs standards#191.

* chore(ci): retarget hypatia-scan wrapper to standards#193 HEAD

Standards #191 was closed in favour of #193 (parallel-session implementation
with simpler API: zero inputs except runs-on). Repointing the wrapper at
#193 HEAD 97df762107501909f50bb770e9bc200b6c415600 so it picks up the merged reusable once #193 lands.

Refs standards#193.

* ci(sweep): codeql actions matrix, workflow permissions

- Replace codeql.yml `javascript-typescript` matrix entry with
  `actions` (repo has no JS/TS source). Matches the canonical fix
  in rsr-template-repo#71 / mtpc#8 / thunderbird#75.
- Add top-level `permissions: contents: read` to workflows flagged
  by governance-reusable's Workflow security linter.

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -29,7 +29,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          # Repo source is not JS/TS; scan workflow files via the
+          # actions extractor (every repo has those). See hypatia rule
+          # codeql_language_matrix_mismatch.
+          - language: actions
             build-mode: none
 
     steps:

.github/workflows/release.yml

@@ -6,6 +6,9 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: read
+
 jobs:
   create-release:
     name: Create Release

.github/workflows/test.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     branches: [ main, develop ]
 
+permissions:
+  contents: read
+
 jobs:
   shellcheck:
     name: ShellCheck