Merge branch 'main' into docs/production-charter-2026-07

Author: hyperpolymath

.github/workflows/echidna-validation.yml

@@ -51,14 +51,17 @@ jobs:
           echo "/tmp/echidna/target/release" >> $GITHUB_PATH
 
       - name: Install proof provers
+        # `isabelle` is not packaged in Ubuntu 24.04 (noble); requesting it
+        # fails the whole job with apt exit 100. validate-with-echidna.sh
+        # reports SKIP for absent provers, so Isabelle proofs are skipped
+        # rather than blocking the pipeline.
         run: |
           set -euo pipefail
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             lean \
             coq \
             agda \
-            isabelle \
             z3
 
       - name: Verify ECHIDNA available

.github/workflows/secret-scanner.yml

@@ -11,6 +11,13 @@ permissions:
   contents: read
 jobs:
   scan:
+    # The reusable workflow's gitleaks job elevates to these permissions;
+    # a called workflow cannot exceed the caller's grant, so they must be
+    # granted here or the run dies with startup_failure.
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
     secrets: inherit
   trufflehog: