fix(ci): changelog caller needs actions:read on the JOB block (top-level is replaced, not merged)

.github/workflows/changelog.yml

@@ -4,10 +4,13 @@
 # (pr-back). Two hard lessons baked in: (1) main is guarded by the
 # Optimus-Branch ruleset (PR-required, signed commits, zero bypass actors —
 # see the optimus-branch-ruleset landmine in STATE.a2ml), which rejects a
-# commit-back direct push; (2) the reusable requests `actions: read`, so the
-# caller MUST declare top-level `actions: read` — omitting it makes GitHub
-# reject the run at startup_failure with zero jobs and no log (both main
-# runs did exactly that on 2026-09-21). Merge the changelog PRs it opens
+# commit-back direct push; (2) the reusable requests `actions: read`, and a
+# job-level `permissions:` block REPLACES the top-level one for that job
+# (it does not merge) — so `actions: read` must ALSO be declared on the
+# job, or GitHub rejects the run at startup_failure with zero jobs and no
+# log ("requesting 'actions: read', but is only allowed 'actions: none'").
+# Three main runs died exactly that way on 2026-09-21/22 before the job
+# key was added. Merge the changelog PRs it opens
 # (squash keeps required_signatures satisfied — GitHub signs the squash
 # commit). Uses the canonical cliff.toml from standards (no local cliff.toml
 # by design — one config for the estate). CHANGELOG.adoc is retained as a

.machine_readable/6a2/STATE.a2ml

@@ -119,7 +119,7 @@ proof-debt = "See [proof-state]. Note the older figure in docs/proof-debt.md (80
 resolve-rsr-source-of-truth = "RESOLVED 2026-09-21: oracle normative, criteria in standards SSOT, aletheia takes the offline subset (see [open-questions].rsr-source-of-truth)"
 empty-merged-prs = "#146 (ci(codeql) cron weekly->monthly) and #147 (Worktree maa ci repair) are BOTH EMPTY — git diff between parent and merge is blank. #146 stated change was already present. A merged PR title is not evidence the change happened; check git diff --stat."
 soundness-axioms = "Fix or delete prob_nonneg, prob_normalized, shannon_entropy_maximum while they are still unused"
-changelog-automation = "RESOLVED 2026-09-21 (#100): changelog.yml adopted (pr-back — commit-back rejected by the Optimus-Branch ruleset, zero bypass actors; caller also needed top-level actions:read after both main runs startup_failed), CHANGELOG.md seeded with the exact reusable recipe, CHANGELOG.adoc frozen as a pointer"
+changelog-automation = "RESOLVED 2026-09-21 (#100): changelog.yml adopted (pr-back — commit-back rejected by the Optimus-Branch ruleset, zero bypass actors; caller needed actions:read on the job block — job-level replaces top-level — after three main runs startup_failed), CHANGELOG.md seeded with the exact reusable recipe, CHANGELOG.adoc frozen as a pointer"
 hypatia-ignore-prune = "RESOLVED 2026-09-21 (#98): all 10 entries verified dead at the pinned submodule commit; .hypatia-ignore is a comments-only audit record, upstream residue in absolute-zero#77"
 submodule-docs = "RESOLVED 2026-09-21: clone block in QUICKSTART-DEV documents `git submodule update --init`"
 
@@ -132,7 +132,10 @@ generic-summary-is-not-detection = "The staleness job prints 'Remove legacy scor
 never-commit-dash-a = "Two separate defects reached main in one `git commit -a` (#142). Never use it in this repo."
 never-allow-dead-code = "Do not silence #125 with #![allow(dead_code)]. The dead code is the specification of the missing feature, and rust-ci.yml's header forbids it."
 never-restore-aletheia-from-mirror = "The in-tree copy is AHEAD — 134 tracked files vs 108, 45 in-tree only. The mirrors' only unique asset is 62 commits of history to 2026-01-03."
-optimus-branch-ruleset = "main is guarded by the Optimus-Branch RULESET (not branch protection — the legacy API 404s): PR-required, signed commits, strict CodeRabbit+governance checks, code-scanning gates, ZERO bypass actors. Direct pushes fail; workflows use pr-back, humans squash-merge."
+optimus-nch-ruleset = "main is guarded by the Optimus-Branch RULESET (not branch protection — the legacy API 404s): PR-required, signed commits, strict CodeRabbit+governance checks, code-scanning gates, ZERO bypass actors. Direct pushes fail; workflows use pr-back, humans squash-merge."
 checker-unwired-until-expressiveness = "check-rsr-profile.sh reports 3 MISSING (nested aletheia/ crate vs root-anchored rust rows) + 1 VESTIGIAL (partial governance quad) — gate-format gaps, not repo defects. Do NOT wire it into CI or trim true declarations until upstream represents partial/nested modules."
 setup-sh-handoff-missing = "setup.sh hands off to `just setup`, but no `setup` recipe exists in Justfile or contractile.just — the universal path is broken until someone writes it. Observed 2026-09-21."
 pages-builds-stub = "pages.yml mkdirs src/ and builds a one-line stub index (README.md absent, docs/ not wired in) — enabling Pages deploys a stub, not the docs. Observed 2026-09-21."
+."
+ath is broken until someone writes it. Observed 2026-09-21."
+pages-builds-stub = "pages.yml mkdirs src/ and builds a one-line stub index (README.md absent, docs/ not wired in) — enabling Pages deploys a stub, not the docs. Observed 2026-09-21."