fix(ci): estate-wide structural CI fixes

- grant secret-scanner reusable its requested job permissions
- drop invalid timeout-minutes on reusable-call jobs
- drop hashFiles() from job-level if: expressions

Author: hyperpolymath

.github/workflows/governance.yml

@@ -28,4 +28,3 @@ permissions:
 jobs:
   governance:
     uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
-    timeout-minutes: 10

.github/workflows/scorecard-enforcer.yml

@@ -54,7 +54,6 @@ jobs:
   # Check specific high-priority items
   check-critical:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Check SECURITY.md exists

.github/workflows/secret-scanner.yml

@@ -12,5 +12,9 @@ permissions:
   contents: read
 jobs:
   scan:
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
     secrets: inherit