ci: fix ECHIDNA scheduled red + Secret Scanner startup_failure (#159)

Phase 0 (ops hygiene) of the production-gap plan.

## What

1. **ECHIDNA Validation** — the scheduled `echidna-verify` job failed
2026-07-06 with apt exit 100: `isabelle` is not packaged in Ubuntu 24.04
(noble). Dropped it from the apt install;
`scripts/validate-with-echidna.sh` already reports SKIP for absent
provers, so Isabelle proofs skip instead of killing the pipeline.
(Push-triggered runs never hit this job — it is schedule/dispatch-only —
which is why main otherwise looked green.)
2. **Secret Scanner** — `startup_failure` on main: the reusable gitleaks
workflow elevates to `pull-requests: write` + `actions: read`, and a
called workflow cannot exceed the caller's grant. Granted those at the
calling `scan` job (the known estate-wide wrapper-permissions class;
same fix proven green elsewhere).

## Verification

- Secret Scanner will prove itself on this PR's own checks.
- ECHIDNA `echidna-verify` is schedule/dispatch-only; I will trigger a
`workflow_dispatch` run after merge to confirm.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/echidna-validation.yml

@@ -51,14 +51,17 @@ jobs:
           echo "/tmp/echidna/target/release" >> $GITHUB_PATH
 
       - name: Install proof provers
+        # `isabelle` is not packaged in Ubuntu 24.04 (noble); requesting it
+        # fails the whole job with apt exit 100. validate-with-echidna.sh
+        # reports SKIP for absent provers, so Isabelle proofs are skipped
+        # rather than blocking the pipeline.
         run: |
           set -euo pipefail
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             lean \
             coq \
             agda \
-            isabelle \
             z3
 
       - name: Verify ECHIDNA available

.github/workflows/secret-scanner.yml

@@ -11,6 +11,13 @@ permissions:
   contents: read
 jobs:
   scan:
+    # The reusable workflow's gitleaks job elevates to these permissions;
+    # a called workflow cannot exceed the caller's grant, so they must be
+    # granted here or the run dies with startup_failure.
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
     secrets: inherit
   trufflehog: