ci: drop secrets: inherit where unused; explicit mirror secrets; scorecard actions: read

secret-scanner and scorecard reusables (standards@75bd5994) declare no secrets
and read none, so secrets: inherit forwarded every repository secret for
nothing. The mirror reusable declares seven optional SSH keys; pass them as an
explicit map (as affinescript-libraries does) instead of inheriting.

The scorecard caller's job-level permissions block replaces the workflow-level
one and dropped actions: read, which the callee's job requests; GitHub refuses
a called job that asks for more than its caller grants. Repeat actions: read in
the job block (CodeRabbit finding on #344, verified against the callee).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV

Author: claude

.github/workflows/mirror.yml

@@ -16,4 +16,13 @@ permissions:
 jobs:
   mirror:
     uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
-    secrets: inherit
+    # Explicit secrets map, not `secrets: inherit` (Hypatia WH008): the callee
+    # (standards@75bd5994) declares exactly these seven, all optional.
+    secrets:
+      GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
+      BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}
+      CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }}
+      SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }}
+      DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }}
+      GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }}
+      RADICLE_KEY: ${{ secrets.RADICLE_KEY }}

.github/workflows/scorecard.yml

@@ -19,9 +19,12 @@ jobs:
     # (its header documents: the caller MUST grant security-events:write
     # + id-token:write; contents:read lets it read the repo). Closes the
     # Hypatia `scorecard_wrapper_missing_job_permissions` finding.
+    # actions: read is repeated here: this job-level block replaces the
+    # workflow-level one, and the callee's job requests actions: read.
+    # The callee declares no secrets, so no `secrets:` line.
     permissions:
+      actions: read
       contents: read
       security-events: write
       id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
-    secrets: inherit

.github/workflows/secret-scanner.yml

@@ -24,4 +24,3 @@ jobs:
       pull-requests: write
       actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
-    secrets: inherit