fix(ci): make the secret scanner run, and repair a parse-dead instant-sync (#53)

Two workflows in this repository are rejected by Actions **at parse
time**, so neither has ever produced a result.

## 1. `secret-scanner.yml` — `jobs:` was empty

The job key `scan:` sat at **column 0**, a sibling of `jobs:` rather
than a child, so `jobs:` parsed as `null` and Actions refused the file.
**Every `Secret Scanner` run in this repository has ended in
`startup_failure`, meaning gitleaks has never executed here.**

This is **valid YAML but invalid Actions**, so YAML-based linting
doesn't catch it — a `yaml.safe_load` sweep over this repo's workflows
passes the file happily. Only Actions' own schema rejects it.

The knock-on: the job-level `permissions:` block granting the
`pull-requests: write` and `actions: read` that the reusable's gitleaks
job requires was attached to a top-level key Actions ignores, so it
never took effect. The reusable SHA pin is untouched.

Fix: indent `scan:` by two spaces. Its child keys were already at four.

## 2. `instant-sync.yml` — misplaced step broke the parse

A sweep appended a `K9-SVC Validation` step at **two-space** indentation
— job-key level — instead of the six spaces that would put it inside the
`dispatch` job's `steps:` list. YAML hit a sequence item where it
expected a block mapping and failed at line 36.

Consequence: **Instant Sync has been `startup_failure` here, so forge
propagation has not been running.**

Re-indented the step and its body. The job now parses with its three
steps as intended.

## Recognising this class

Both faults share a signature:

- the run is listed by **file path** instead of workflow name
- `gh run view --log-failed` returns **"log not found"**
- `gh pr checks` shows **nothing** — a parse-rejected workflow creates
no check run

Only `gh run list --json conclusion` reveals them.

## Estate context

- The col-0 `jobs:` fault is **narrow**: a scan of all 13,330 workflow
files across `hyper-repos`/`meta-repos`/`repos` found it in exactly
**two** repositories — this one and `wokelang`, byte-identical in shape.
wokelang is fixed in hyperpolymath/wokelang#129.
- The misplaced `K9-SVC Validation` step is **not** narrow — the same
mis-indentation appears in **59 workflow files** estate-wide (against 12
correctly indented). Reported separately.

## Note on branching

Branched from `origin/main` deliberately. The local checkout carried two
unpushed sweep-authored commits (`chore: estate-wide security
compliance`, `chore: remove duplicate GOVERNANCE files`) that are not
part of this fix and were not inherited.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/instant-sync.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Confirm
         run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"
 
-  - name: K9-SVC Validation
-    run: |
-      echo "K9-SVC validation"
-      [ -d .machine_readable/contractiles ] && echo "Contractiles present" || echo "No contractiles"
+      - name: K9-SVC Validation
+        run: |
+          echo "K9-SVC validation"
+          [ -d .machine_readable/contractiles ] && echo "Contractiles present" || echo "No contractiles"

.github/workflows/secret-scanner.yml

@@ -10,8 +10,7 @@ concurrency:
 permissions:
   contents: read
 jobs:
-
-scan:
+  scan:
     # The reusable's gitleaks job requests pull-requests: write (PR summary
     # comment) and actions: read (workflow-run metadata) at job level; the
     # caller must grant at least that or the run startup-fails.