fix(ci): grant the secret-scanner reusable its required job permissions

The scan job calls secret-scanner-reusable.yml, whose gitleaks job declares
pull-requests: write (PR summary comment) and actions: read (workflow-run
metadata) at job level. A called reusable workflow may only request
permissions equal to or more restrictive than its caller, and this caller
granted only the file-level contents: read — so GitHub refused the run at
parse time. Every Secret Scanner run ended in startup_failure, meaning
secret scanning has never actually executed in this repo.

Grants the superset at job level, matching the canonical template and the
176 estate repos whose scanner already runs. No SHA pin is changed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -11,6 +11,13 @@ permissions:
   contents: read
 jobs:
   scan:
+    # The reusable's gitleaks job requests pull-requests: write (PR summary
+    # comment) and actions: read (workflow-run metadata) at job level; the
+    # caller must grant at least that or the run startup-fails.
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
     secrets: inherit
   trufflehog: