fix(ci): cure startup_failure cluster + true-up README claims

[hyperpolymath]

What

Fixes the five-workflow startup_failure cluster on main and trues the README up to what is actually on disk.

The two startup-failure mechanisms

1. Empty Actions allowlist — the repo policy is selected with patterns_allowed: [], so any workflow referencing a non-GitHub-owned, non-verified action (dawidd6/action-send-mail, haskell-actions/setup, peter-evans/repository-dispatch, plus the third-party actions inside the standards governance reusable) was rejected at plan time with 0 jobs. Fixed in repo settings (13 patterns added, all SHA-pin-enforced anyway via sha_pinning_required); the prior state is backed up.
2. Caller permissions narrower than the called reusable requests — scorecard-reusable requests security-events: write + id-token: write; a called reusable workflow cannot escalate past the caller's grant, so the run died at startup. scorecard.yml now grants them. (This is why hypatia-scan.yml, whose reusable only asks security-events: read that the caller already granted, kept running while Scorecard/Governance died.)

Also in this PR

• Bump all five standards reusable pins d135b05 → a44c93a — picks up the report-only Hypatia gate ("warn, fix forward") and the baseline-validation job that skips cleanly when no .hypatia-baseline.json exists. Both are required status checks on main, so without this every future PR deadlocks (this morning's Hypatia scan failure was the pre-#449-stopgap gate failing on any finding).
• Remove invalid timeout-minutes from reusable-call jobs in secret-scanner.yml / mirror.yml — same class as cartridges#70; unsupported keys on a uses: job invalidate the whole workflow file.
• Pin trufflesecurity/trufflehog@main → v3.95.6 SHA (repo requires SHA pinning; @main was rejected).
• Gate instant-sync dormant behind vars.INSTANT_SYNC_ENABLED — its FARM_DISPATCH_TOKEN was retired in the 2026-06-30 credential rebuild; re-arm by setting the variable once the replacement fine-grained PAT exists.
• README truth-up: 101→114 registry adapters (disk count), 547→824 tests + 68 properties (disk count), disclose that ~10 adapters target planned registries for hyperpolymath's own languages via git fallback, point the OPSM UI section at the in-repo opsm-ui/ directory (the hyperpolymath/opsm-ui GitHub repo does not exist), and reword "Formal Verification" to "Formal Methods … proofs tracked in PROOF-NEEDS.md" (the Idris2 ABI is a totality-checked model; correctness theorems are still open). Historical release notes are left as-released.

Verification

• All five reusables re-inspected at a44c93a for permission requests and required inputs (governance/hypatia/secret-scanner/mirror need only contents: read; callers already secrets: inherit where the reusable wants it).
• Adapter and test counts measured from disk: ls opsm_ex/lib/opsm/registries/*.ex | wc -l = 114; grep -c 'test "' = 824, property " = 68.

🤖 Generated with Claude Code