fix(ci): remove orphan mapping key that made scorecard.yml unparseable

`permissions: read-all` is a SCALAR. The indented `actions: read`
beneath it is a mapping entry under a scalar, which is invalid YAML,
so GitHub never parsed this workflow: the run emits zero jobs and the
Scorecard check never appears at all.

The gate was therefore ABSENT, not red — which is why this survived
unnoticed. `read-all` already grants `actions: read`, so deleting the
orphan line restores the file with no loss of permission.

Same repair as aerie#76, merged 2026-09-13.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

Author: hyperpolymath

.github/workflows/scorecard.yml

@@ -9,7 +9,6 @@ on:
     branches: [main]
 
 permissions: read-all
-  actions: read
 
 jobs:
   analysis: