chore(ci): return scorecard.yml to PR #55

scorecard.yml is already repaired on branch fix/repair-startup-dead-scorecard-yml
(PR #55), which re-indents `actions: read` INTO the analysis job's own
permissions block. That is the correct cure: job-level permissions REPLACE the
top-level map, so the analysis job never inherited `read-all` and Scorecard was
running without `actions: read`. Deleting the stray line made the file parse but
left the job functionally short.

Restoring this file from main so PR #55 owns it uncontested.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

Author: hyperpolymath

.github/workflows/scorecard.yml

@@ -9,6 +9,7 @@ on:
     branches: [main]
 
 permissions: read-all
+  actions: read
 
 jobs:
   analysis: