fix(ci): grant actions: read so the governance reusable can start

The reusable at the pinned standards revision requires actions: read. A caller
granting only contents: read dies at startup and reports NO governance checks at
all, silently disarming the whole gate (0 checks instead of 15).

Verified on bofig: run 34200437178 at the patched head reported all 15 governance
jobs; before the patch the run was startup_failure with zero checks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519

Author: hyperpolymath

.github/workflows/governance.yml

@@ -27,6 +27,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs: