fix(scorecard): scope workflow-level permissions to contents:read

Workflow-level `permissions: read-all` capped the GITHUB_TOKEN to
read-only across all scopes. With reusable-workflow permission scoping,
this caps the called workflow's `security-events: write` /
`id-token: write` declarations, blocking scorecard SARIF upload.
Manifests as startup_failure with no logs.

30 consecutive startup_failures on main since 2026-05-30. Canonical
shape per feedback_scorecard_wrapper_caller_permissions.md:
workflow-level `contents: read` + job-level write scopes.

Fan-out planned for downstream wrappers if green here.

Author: hyperpolymath

.github/workflows/scorecard.yml

@@ -8,7 +8,8 @@ on:
   push:
     branches: [main]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis: