CI hygiene: gate secret dispatch; split scorecard publish from score gate

Address the two remaining high-severity Hypatia workflow-audit findings
(both pre-existing):

- instant-sync.yml (secret_action_without_presence_gate): gate the
  peter-evans/repository-dispatch step on FARM_DISPATCH_TOKEN presence via
  a job-level env + step-level if, so it skips cleanly where the secret is
  absent instead of running with an empty token.

- scorecard-enforcer.yml (scorecard_publish_with_run_step): split the
  privileged publish job (id-token: write) from the score enforcement.
  The scorecard job now only analyzes, publishes, and uploads SARIF (no
  run: steps); a new unprivileged score-gate job (contents: read)
  re-derives the score read-only and fails on a low score. publish_results
  does not affect the computed score, so the gate behaviour is unchanged.
  No new actions introduced (reuses already-pinned actions).

Author: claude

.github/workflows/instant-sync.yml

@@ -15,8 +15,14 @@ jobs:
   dispatch:
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    env:
+      FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
     steps:
       - name: Trigger Propagation
+        # Presence gate: only dispatch when the secret is configured (e.g.
+        # skip on forks / environments without FARM_DISPATCH_TOKEN) rather
+        # than failing the action with an empty token.
+        if: ${{ env.FARM_DISPATCH_TOKEN != '' }}
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}

.github/workflows/scorecard-enforcer.yml

@@ -44,6 +44,29 @@ jobs:
         with:
           sarif_file: results.sarif
 
+  # Unprivileged enforcement gate. Re-derives the score read-only (no
+  # publish, no id-token) and fails on a low score. Kept separate from the
+  # privileged `scorecard` publish job above so that arbitrary run: steps
+  # never execute in a job that holds id-token: write
+  # (Hypatia: scorecard_publish_with_run_step). publish_results does not
+  # affect the computed score, so the gate behaviour is unchanged.
+  score-gate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run Scorecard (analysis only)
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: false
+
       - name: Check minimum score
         run: |
           # Parse score from results