fix(ci): startup_failure class — callee-permission grants, stale pins, filled placeholders

Central five-front diagnosis (wf_58d387b3): no broken SHA anywhere. Fixes:

- Cause B (callee ⊆ caller): standards' secret-scanner-reusable (gitleaks:
  pull-requests:write + actions:read) and scorecard-reusable (security-events:
  write + id-token:write) declare job scopes the thin callers didn't grant —
  GitHub requires callee ⊆ caller, so both startup-failed at plan time with
  zero jobs (persisting after #31's repin, which could never fix a permission
  mismatch). Callers now grant the union.
- Stale pin: rust-ci d135b05 predates the standards rust-toolchain fix
  (9fe0d8f) — re-pinned to a44c93a5 (2026-07-01 HEAD); secret-scanner and
  scorecard re-pinned alongside for one coherent baseline.
- openssf-compliance content: .github/SECURITY.md carried 12 unfilled {{…}}
  template tokens — replaced with the estate's filled policy (ported from
  cicd-squabbler's, honest no-published-PGP wording, GH advisories preferred);
  ECOSYSTEM.a2ml purpose filled from the repo's own EXPLAINME identity.

Out of scope: Pages enable (repo setting, listed for owner), the standards-side
source fix for cause B (owner-gated), dependabot trim (landed in #33).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/SECURITY.md

@@ -1,22 +1,8 @@
-# Security Policy
-
-<!-- 
-============================================================================
-TEMPLATE INSTRUCTIONS (delete this block before publishing)
-============================================================================
-Replace all  values with your information:
-  Patch Bridge     - Your project name
-  hyperpolymath            - GitHub username or org (e.g., hyperpolymath)
-  patch-bridge             - Repository name
-  {{SECURITY_EMAIL}}   - Security contact email
-  {{PGP_FINGERPRINT}}  - Your PGP key fingerprint (40 chars, no spaces)
-  {{PGP_KEY_URL}}      - URL to your public PGP key
-  {{WEBSITE}}          - Your website/domain
-  2026     - Current year for copyright
-
-Optional: Remove sections that don't apply (e.g., PGP if you don't use it)
-============================================================================
+<!--
+SPDX-License-Identifier: CC-BY-SA-4.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -->
+# Security Policy
 
 We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions.
 
@@ -52,26 +38,11 @@ This method ensures:
 - Coordinated disclosure tooling
 - Automatic credit when the advisory is published
 
-### Alternative: Encrypted Email
-
-If you cannot use GitHub Security Advisories, you may email us directly:
+### Alternative: Email
 
-| | |
-|---|---|
-| **Email** | {{SECURITY_EMAIL}} |
-| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) |
-| **Fingerprint** | `{{PGP_FINGERPRINT}}` |
-
-```bash
-# Import our PGP key
-curl -sSL {{PGP_KEY_URL}} | gpg --import
-
-# Verify fingerprint
-gpg --fingerprint {{SECURITY_EMAIL}}
-
-# Encrypt your report
-gpg --armor --encrypt --recipient {{SECURITY_EMAIL}} report.txt
-```
+If you cannot use GitHub Security Advisories, you may email the maintainer
+directly at j.d.a.jewell@open.ac.uk. There is no published PGP key at
+present; for an encrypted channel, prefer GitHub Security Advisories (above).
 
 > **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media.
 
@@ -323,7 +294,7 @@ To stay informed about security updates:
 
 - **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts"
 - **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/hyperpolymath/patch-bridge/security/advisories)
-- **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md)
+- **Release notes**: Security fixes noted in [CHANGELOG](../CHANGELOG.md)
 
 ### Update Policy
 
@@ -348,7 +319,7 @@ To stay informed about security updates:
 
 ## Security Best Practices
 
-When using Patch Bridge, we recommend:
+When using patch-bridge, we recommend:
 
 ### General
 
@@ -370,9 +341,8 @@ When using Patch Bridge, we recommend:
 
 ## Additional Resources
 
-- [Our PGP Public Key]({{PGP_KEY_URL}})
 - [Security Advisories](https://github.com/hyperpolymath/patch-bridge/security/advisories)
-- [Changelog](CHANGELOG.md)
+- [Changelog](../CHANGELOG.md)
 - [Contributing Guidelines](CONTRIBUTING.md)
 - [CVE Database](https://cve.mitre.org/)
 - [CVSS Calculator](https://www.first.org/cvss/calculator/3.1)
@@ -383,9 +353,9 @@ When using Patch Bridge, we recommend:
 
 | Purpose | Contact |
 |---------|---------|
-| **Security issues** | [Report via GitHub](https://github.com/hyperpolymath/patch-bridge/security/advisories/new) or {{SECURITY_EMAIL}} |
+| **Security issues** | [Report via GitHub](https://github.com/hyperpolymath/patch-bridge/security/advisories/new) or j.d.a.jewell@open.ac.uk |
 | **General questions** | [GitHub Discussions](https://github.com/hyperpolymath/patch-bridge/discussions) |
-| **Other enquiries** | See [README](README.md) for contact information |
+| **Other enquiries** | See [README](../README.adoc) for contact information |
 
 ---
 
@@ -399,7 +369,7 @@ This security policy may be updated from time to time. Significant changes will
 
 ---
 
-*Thank you for helping keep Patch Bridge and its users safe.* 🛡️
+*Thank you for helping keep patch-bridge and its users safe.* 🛡️
 
 ---
 

.github/workflows/rust-ci.yml

@@ -14,4 +14,4 @@ permissions:
 
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@a44c93a5cd3d293ee3e8b488444dcdc19c4e5d49

.github/workflows/scorecard.yml

@@ -8,9 +8,16 @@ on:
   push:
     branches: [main]
 
-permissions: read-all
+# The reusable's scorecard job declares security-events:write + id-token:write;
+# a called workflow's job permissions must be a SUBSET of the caller's grant
+# (callee ⊆ caller) — `read-all` grants no writes, so the run startup-failed at
+# plan time with zero jobs.
+permissions:
+  contents: read
+  security-events: write
+  id-token: write
 
 jobs:
   analysis:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@a44c93a5cd3d293ee3e8b488444dcdc19c4e5d49
     secrets: inherit

.github/workflows/secret-scanner.yml

@@ -10,10 +10,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# The reusable's gitleaks job declares pull-requests:write + actions:read; a
+# called workflow's job permissions must be a SUBSET of the caller's grant
+# (callee ⊆ caller), so the caller grants the union or the run startup-fails
+# at plan time with zero jobs.
 permissions:
   contents: read
+  pull-requests: write
+  actions: read
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@a44c93a5cd3d293ee3e8b488444dcdc19c4e5d49
     secrets: inherit

.machine_readable/ECOSYSTEM.a2ml

@@ -4,5 +4,5 @@
   (version "1.0.0")
   (name "patch-bridge")
   (type "library")
-  (purpose "{{REPO_DESCRIPTION}}")
+  (purpose "Reachability-aware CVE triage engine: Cargo.lock -> OSV batch query -> import-scan reachability -> Mitigable/Unmitigable/Informational classification")
   (related-projects))