Three pre-existing red non-required checks on main: Allowlist Preflight (empty GH_TOKEN), Workflow security linter (duplicate with in abi-drift.yml), SonarQube (403) #338

Summary

Three non-required checks are red on main and have been since before #337 (measured on 3c3f2621 and e1eefa45, 2026-10-06). None blocks a merge (the only required context is scan / gitleaks), but each one is a real defect, so #337 defers them here rather than hiding them. One issue, three acceptance criteria, so the pile grows by one.

1. governance / Allowlist Preflight — exit 3, cannot read live Actions permissions

Log (run 37468005902, job 112283831352): GH_TOKEN: is empty in the "check-actions-policy" step, gh refuses to run, the script prints ERROR: could not read live Actions permissions for hyperpolymath/boj-server and exits 3.

Cause: governance.yml calls hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587 and passes no secrets. At that pin the reusable sets GH_TOKEN: ${{ secrets.HYPATIA_SCAN_PAT }} (declared required: false) and fails hard when it is empty. boj-server-cartridges calls the same reusable at 9e9513b1, also with no secrets, and its Allowlist Preflight is green on main, so the newer pin tolerates the absent token.

Acceptance: bump the governance pin to 9e9513b1 or later (regenerate .github/workflows/actions.lock in the same commit, per the lock gates), or pass HYPATIA_SCAN_PAT from the caller; governance / Allowlist Preflight is green on the main head that lands it.

2. governance / Workflow security linter — duplicate with key in abi-drift.yml

Log (job 112283831223): FAIL .github/workflows/abi-drift.yml: duplicate key(s): 'with' (line 86). The "Install Rust toolchain (stable)" step carries two with: maps (toolchain: v1 then toolchain: stable). GitHub rejects the file before any job is created, so abi-drift.yml has not run at all since the duplicate was introduced; an ordinary YAML parser keeps the last key and reports success, which is why nothing else caught it.

Acceptance: one with: map with toolchain: stable; governance / Workflow security linter green; the ABI drift workflow produces a check run on the next pull_request that touches src/abi/ or ffi/.

3. SonarQube — HTTP 403 from SonarCloud

Log (run 37468004225, job 112283822510): GET https://api.sonarcloud.io/analysis/jres?os=linux&arch=x86_64 failed with HTTP 403 Forbidden. Please check the property sonar.token or the environment variable SONAR_TOKEN. The scanner never reaches analysis. Sibling of hyperpolymath/boj-server-cartridges#96.

Acceptance: owner action — a valid SONAR_TOKEN for this project in the repo secrets (set from a real terminal or the web UI, then proved by a green run, not by the secret's updated_at), or the workflow conditioned off until one exists; SonarQube green or skipped-by-design on main, and if it is ever made required, "required" means the quality gate passes.

Scope

Deferred from #337 (a gitleaks-only fix) under AGENTS.md §5c item 3. Each criterion is independently small; 1 and 2 are a single follow-up PR, 3 is an owner action.

https://claude.ai/code/session_0144BSwhFVjj4EJ2u7Y2VHWf