ci: unbreak standards' own secret scanning; SPDX + pin pages.yml (#511)

## The main fix: standards' own secret scanning has not run since
2026-07-06

`secret-scanner.yml` pinned the reusable at `@891b1ed` (2026-07-06),
which is **21 commits behind #500** (`08e2d246`). At that pin the
reusable's `gitleaks` job requests `pull-requests: write` + `actions:
read`, but this caller grants only `contents: read`. A called workflow
cannot exceed its caller's grant, so **every run terminated at
`startup_failure`**:

```
startup_failure  main                                        2026-07-20T17:36
startup_failure  test/signed-push-smoke                       2026-07-20T17:33
startup_failure  main                                        2026-07-20T17:24
startup_failure  feat/signed-push-app-action                  2026-07-20T16:55
startup_failure  main                                        2026-07-20T13:43
startup_failure  dependabot/github_actions/actions-5fa456a2a3 2026-07-20T13:28
```

This is worse than a fake-green gate: the scan never executed at all, on
the repo that *defines* the estate's secret-scanning standard.

**Fix:** use the local relative path
`./.github/workflows/secret-scanner-reusable.yml`, mirroring the
`governance.yml` exemplar. This repo owns the reusable, so it should
always scan itself with the current version — and a local path **cannot
re-stale**, so this class of breakage cannot recur here. The current
reusable needs only `contents: read`, so the existing grant is already
correct (the in-file comment was accurate; only the pin was stale).

### Estate-wide corollary (not fixed here)

The same `@d135b05` / pre-#500 pins are still in place on callers across
the estate. Verified for the record:

```
$ gh api repos/hyperpolymath/standards/compare/08e2d246...d135b05
{"status":"behind","ahead":0,"behind":64}
```

At `d135b05` the gitleaks step is literally:

```yaml
- name: Gitleaks Secret Scan
  continue-on-error: true   # <-- cannot fail
  uses: gitleaks/gitleaks-action@e0c47f4f...
```

versus current `main`:

```yaml
- name: Install gitleaks (pinned + checksum-verified)   # sha256-verified binary
- name: Gitleaks secret scan (gating)
  run: ... gitleaks detect ... --exit-code 1            # gates for real
```

So bumping those caller pins is **not cosmetic staleness** — it converts
the estate's primary secret scanner from cannot-fail to actually-gating,
*and* drops the permission demand to `contents: read` (removing the
startup_failure hazard). That caller sweep is tracked separately.

## Secondary fixes

- **`pages.yml`** (added in #503): had no SPDX header — tripping the
governance "missing SPDX header" gate — and four unpinned tag refs,
which the estate Actions policy rejects at run creation. Added `MPL-2.0`
(**this repo's licence — deliberately not AGPL**) and pinned all four to
release SHAs, keeping the current majors: `checkout` v7.0.0,
`upload-pages-artifact` v5.0.0, `deploy-pages` v5.0.0. (Note:
paint-type's pages.yml pins v3/v4 — copying those here would be a
downgrade.)
- **`spark-theatre-gate.yml`**: corrected a mislabelled pin comment —
SHA `9c091bb2` is v7.0.0, not v4. Cosmetic, no behavioural change.

## Verification

- All three files parse (`yaml.safe_load`).
- The `startup_failure` claim is from `gh run list`, not inference; this
PR's own Secret Scanner run is the direct test — it should execute
rather than startup_failure.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/pages.yml

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 name: GitHub Pages (Ddraig SSG)
 on:
   push:
@@ -18,9 +19,9 @@ jobs:
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
       - name: Checkout Site
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Checkout Ddraig SSG
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg
@@ -37,7 +38,7 @@ jobs:
           fi
           ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: '_site'
   deploy:
@@ -50,4 +51,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/secret-scanner.yml

@@ -18,5 +18,14 @@ jobs:
     # The reusable's gitleaks job no longer requests elevated permissions
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@891b1ed6164478616cb3375f328c6487ccb13f80
+    # Local relative path, not an external SHA pin — this is the repo that
+    # *owns* the reusable, so it must scan itself with the current version
+    # (same pattern as governance.yml). The previous pin
+    # @891b1ed6164478616cb3375f328c6487ccb13f80 (2026-07-06) predated #500 and
+    # still requested `pull-requests: write` + `actions: read`; a called
+    # workflow cannot exceed its caller's grant, and this caller grants only
+    # `contents: read`, so every run died at startup_failure — standards' own
+    # secret scanning had not executed since that pin landed. A local path
+    # cannot re-stale, so this class of breakage cannot recur here.
+    uses: ./.github/workflows/secret-scanner-reusable.yml
     secrets: inherit

.github/workflows/spark-theatre-gate.yml

@@ -64,7 +64,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan for SPARK proof theatre
         env: