fix(ci): make the secret scanner run, and repair a parse-dead instant-sync

[hyperpolymath]

Two workflows in this repository are rejected by Actions at parse time, so neither has ever produced a result.

1. secret-scanner.yml — jobs: was empty

The job key scan: sat at column 0, a sibling of jobs: rather than a child, so jobs: parsed as null and Actions refused the file. Every Secret Scanner run in this repository has ended in startup_failure, meaning gitleaks has never executed here.

This is valid YAML but invalid Actions, so YAML-based linting doesn't catch it — a yaml.safe_load sweep over this repo's workflows passes the file happily. Only Actions' own schema rejects it.

The knock-on: the job-level permissions: block granting the pull-requests: write and actions: read that the reusable's gitleaks job requires was attached to a top-level key Actions ignores, so it never took effect. The reusable SHA pin is untouched.

Fix: indent scan: by two spaces. Its child keys were already at four.

2. instant-sync.yml — misplaced step broke the parse

A sweep appended a K9-SVC Validation step at two-space indentation — job-key level — instead of the six spaces that would put it inside the dispatch job's steps: list. YAML hit a sequence item where it expected a block mapping and failed at line 36.

Consequence: Instant Sync has been startup_failure here, so forge propagation has not been running.

Re-indented the step and its body. The job now parses with its three steps as intended.

Recognising this class

Both faults share a signature:

• the run is listed by file path instead of workflow name
• gh run view --log-failed returns "log not found"
• gh pr checks shows nothing — a parse-rejected workflow creates no check run

Only gh run list --json conclusion reveals them.

Estate context

• The col-0 jobs: fault is narrow: a scan of all 13,330 workflow files across hyper-repos/meta-repos/repos found it in exactly two repositories — this one and wokelang, byte-identical in shape. wokelang is fixed in fix(ci): make the secret scanner and the Lean proof gate actually run wokelang#129.
• The misplaced K9-SVC Validation step is not narrow — the same mis-indentation appears in 59 workflow files estate-wide (against 12 correctly indented). Reported separately.

Note on branching

Branched from origin/main deliberately. The local checkout carried two unpushed sweep-authored commits (chore: estate-wide security compliance, chore: remove duplicate GOVERNANCE files) that are not part of this fix and were not inherited.

🤖 Generated with Claude Code