fix(ci): pass GITHUB_TOKEN to Hypatia scanner in reusable workflow (#428)

The reusable scan workflow never set GITHUB_TOKEN in the "Run Hypatia
scan" step, so the scanner's Dependabot / code-scanning /
secret-scanning alert checks were always skipped with "GITHUB_TOKEN not
set" warnings across every repo that calls this workflow.

Set it to `secrets.HYPATIA_SCAN_PAT || secrets.GITHUB_TOKEN`:

- Prefer a fine-grained, read-only PAT inherited as an org Actions
secret (HYPATIA_SCAN_PAT) -- the built-in Actions token CANNOT read
Dependabot alerts (no `dependabot` permission exists for GITHUB_TOKEN).
- Fall back to the built-in token so code-scanning alerts still resolve
in repos where the PAT is not present yet.

This silences the three warnings fleet-wide once the org secret exists.
It does not change the severity gate (medium+ findings still fail CI).


Claude-Session: https://claude.ai/code/session_01V13sGvHnaeCY5A9fF2QsDm

<!--
SPDX-License-Identifier: CC-BY-SA-4.0
Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-->
## Summary

<!-- What does this PR do, and why? -->

Closes #

## Type of change

- [ ] 🐛 Bug fix (non-breaking change that fixes an issue)
- [ ] ✨ New feature (non-breaking change that adds functionality)
- [ ] 💥 Breaking change (would change existing behaviour)
- [ ] 🕳️ Soundness fix (fixes a checker/proof false-negative)
- [ ] 📖 Documentation
- [ ] 🧹 Refactor / tech debt (behaviour-preserving)
- [ ] ⚡ Performance
- [ ] 🔧 Build / CI / tooling

## How has this been verified?

<!-- Establish ground truth: which tool did you RUN, and what did it
report?
     Don't cite a status doc — cite the command and its output. -->

## Checklist

- [ ] My commits are **signed** (`git commit -S`).
- [ ] I ran the project's own checks/tests locally and they pass.
- [ ] New files carry the correct `SPDX-License-Identifier` (code/config
`MPL-2.0`,
      prose `CC-BY-SA-4.0`); I did not relicense existing files.
- [ ] Docs are updated, and no public claim now overstates what the code
does.
- [ ] I have not introduced a soundness hole (or I have flagged where I
might have).

## Notes for reviewers

<!-- Anything that needs special attention, follow-up, or context. -->

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/hypatia-scan-reusable.yml

@@ -49,6 +49,18 @@ jobs:
 
       - name: Run Hypatia scan
         id: scan
+        env:
+          # The scanner reads a single env var, GITHUB_TOKEN, to pull Dependabot,
+          # code-scanning and secret-scanning alerts (lib/rules/{dependabot,
+          # code_scanning,secret_scanning}_alerts.ex). Without it those three
+          # checks are skipped with "GITHUB_TOKEN not set" warnings.
+          #
+          # Prefer a fine-grained, read-only PAT (HYPATIA_SCAN_PAT, inherited as
+          # an org secret via the caller's `secrets: inherit`): the built-in
+          # Actions token CANNOT read Dependabot alerts (no `dependabot`
+          # permission exists for it). Fall back to the built-in token so
+          # code-scanning still works in repos where the PAT isn't present yet.
+          GITHUB_TOKEN: ${{ secrets.HYPATIA_SCAN_PAT || secrets.GITHUB_TOKEN }}
         run: |
           echo "Scanning repository: ${{ github.repository }}"
           # --exit-zero: hypatia-cli exits 1 when findings exist; under the default