fix(ci): grant secret-scanner caller the permissions its reusable requests (#63)

Secret Scanner was the last `startup_failure` on main: the gitleaks job
in `secret-scanner-reusable` requests `pull-requests: write` + `actions:
read`, and a called reusable workflow cannot escalate past the caller's
grant. Same mechanism as the scorecard fix in #61 — this caller was
missed because it wasn't among the sampled failing runs. One-line
permissions grant.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -8,8 +8,13 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+# The called reusable's gitleaks job requests pull-requests:write +
+# actions:read (PR summary comments); a called workflow cannot escalate
+# past the caller's grant, so they must be granted here.
 permissions:
   contents: read
+  pull-requests: write
+  actions: read
 jobs:
   scan:
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@a44c93a5cd3d293ee3e8b488444dcdc19c4e5d49