fix(ci): grant the secret-scanner reusable its required job permissions (#36)

Every `Secret Scanner` run in this repo has been ending in
**`startup_failure`** — meaning **secret scanning has never actually
executed** here.

### Root cause

A called reusable workflow may only request permissions **equal to or
more restrictive than its caller**. This is enforced when the workflow
file is *parsed*, before a runner is allocated — which is why it
surfaces as `startup_failure` with no logs and no annotations.

`secret-scanner-reusable.yml` declares this on its `gitleaks` job:

```yaml
permissions:
  contents: read
  pull-requests: write   # gitleaks-action posts the PR summary comment
  actions: read          # workflow-run metadata / PR-files endpoint
```

This caller granted only the file-level `permissions: contents: read`,
so the reusable was asking for more than the caller had. GitHub refused
the run outright.

### Evidence

Two repos pinning the **identical** reusable SHA behave differently
based only on this block: `modshells` (grants the superset) runs fine;
`verisimdb` (does not) `startup_failure`s. Estate-wide, 176 callers
grant it and run; 26 do not and are all dead.

### Fix

Grant the superset at job level — byte-identical to the canonical
template. **No SHA pin is changed**, so the scanned content and
supply-chain posture are unaffected; this only lets the existing pinned
scanner start.

### Verification

After merge, `Secret Scanner` should move from `startup_failure` to an
actual run with `gitleaks` / `rust-secrets` / `shell-secrets` jobs.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -11,6 +11,13 @@ permissions:
   contents: read
 jobs:
   scan:
+    # The reusable's gitleaks job requests pull-requests: write (PR summary
+    # comment) and actions: read (workflow-run metadata) at job level; the
+    # caller must grant at least that or the run startup-fails.
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
     secrets: inherit
   trufflehog: