fix(ci): make the secret scanner and the Lean proof gate actually run

.github/workflows/lean-proofs.yml

@@ -57,19 +57,19 @@ jobs:
           lean docs/proofs/verification/WokeGrammarStructure.lean
           echo "✅ WokeGrammarStructure.lean verified"
 
-      - name: Verify WokeGrammarRegular.lean (§7.1 not-regular: DFA + pigeonhole)
+      - name: "Verify WokeGrammarRegular.lean (§7.1 not-regular: DFA + pigeonhole)"
         run: |
           set -euo pipefail
           lean docs/proofs/verification/WokeGrammarRegular.lean
           echo "✅ WokeGrammarRegular.lean verified"
 
-      - name: Verify WokeGrammarCFL.lean (§7.3 CFL closure: union/concat/star)
+      - name: "Verify WokeGrammarCFL.lean (§7.3 CFL closure: union/concat/star)"
         run: |
           set -euo pipefail
           lean docs/proofs/verification/WokeGrammarCFL.lean
           echo "✅ WokeGrammarCFL.lean verified"
 
-      - name: Verify WokeGrammarPumping.lean (§7.3 non-closure: pumping foundation)
+      - name: "Verify WokeGrammarPumping.lean (§7.3 non-closure: pumping foundation)"
         run: |
           set -euo pipefail
           lean docs/proofs/verification/WokeGrammarPumping.lean

.github/workflows/secret-scanner.yml

@@ -10,7 +10,7 @@ concurrency:
 permissions:
   contents: read
 jobs:
-scan:
+  scan:
     # The reusable's gitleaks job requests pull-requests: write (PR summary
     # comment) and actions: read (workflow-run metadata) at job level; the
     # caller must grant at least that or the run startup-fails.