ci: fix ECHIDNA scheduled red + Secret Scanner startup_failure

- echidna-validation: drop 'isabelle' from apt install — not packaged in
  Ubuntu 24.04 (noble), so the scheduled echidna-verify job died with apt
  exit 100 before running anything. validate-with-echidna.sh already SKIPs
  absent provers, so Isabelle proofs skip instead of blocking.
- secret-scanner: grant contents:read + pull-requests:write + actions:read
  at the calling 'scan' job — the reusable workflow's gitleaks job elevates
  to these and a called workflow cannot exceed the caller's grant, which
  produced the startup_failure.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/echidna-validation.yml

@@ -51,14 +51,17 @@ jobs:
           echo "/tmp/echidna/target/release" >> $GITHUB_PATH
 
       - name: Install proof provers
+        # `isabelle` is not packaged in Ubuntu 24.04 (noble); requesting it
+        # fails the whole job with apt exit 100. validate-with-echidna.sh
+        # reports SKIP for absent provers, so Isabelle proofs are skipped
+        # rather than blocking the pipeline.
         run: |
           set -euo pipefail
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             lean \
             coq \
             agda \
-            isabelle \
             z3
 
       - name: Verify ECHIDNA available

.github/workflows/secret-scanner.yml

@@ -11,6 +11,13 @@ permissions:
   contents: read
 jobs:
   scan:
+    # The reusable workflow's gitleaks job elevates to these permissions;
+    # a called workflow cannot exceed the caller's grant, so they must be
+    # granted here or the run dies with startup_failure.
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
     secrets: inherit
   trufflehog: