CI red on main: empty Actions allowlist + 3 malformed workflow files (dogfood-gate, workflow-linter, e2e) + misplaced rust-ci

[hyperpolymath]

Summary

main CI is red from a mix of a repo-settings cause and three malformed workflow files copied from the template. Captured here so the fix is tracked; ground-truthed 2026-07-18.

1. Empty Actions allowlist → 6 × startup_failure (owner action)

actions/permissions/selected-actions has patterns_allowed: [] (with github_owned_allowed: true, verified_allowed: true). Every workflow that uses a third-party action or a hyperpolymath/standards reusable is refused at startup (0 s, startup_failure) because no third-party pattern is allowed.

Fix — a settings write the bot is classifier-blocked from; repo owner must run:

gh api repos/hyperpolymath/standards/actions/permissions/selected-actions \
  --jq '{github_owned_allowed,verified_allowed,patterns_allowed}' \
| gh api -X PUT repos/hyperpolymath/ideas-to-alphas/actions/permissions/selected-actions --input -

Prevention is tracked upstream in hyperpolymath/standards#486 (wire an allowlist preflight into the governance gate). chronicles-of-slavia is in the same cluster.

2. .github/workflows/dogfood-gate.yml — YAML syntax error

could not find expected ':' while scanning a simple key at line 266, column 1 (Psych/libyaml). The workflow cannot start until this is fixed.

3. .github/workflows/workflow-linter.yml — YAML syntax error

mapping values are not allowed in this context at line 64, column 13.

4. .github/workflows/e2e.yml — zero jobs defined

Parses cleanly, but every job block under jobs: is a commented-out placeholder ("Uncomment ONE of the following e2e job blocks…"), so the file defines no jobs. GitHub requires ≥1 job, so this is invalid / a no-op. Either wire up the real e2e job for this stack or remove the file.

5. .github/workflows/rust-ci.yml — misplaced template copy

Parses, but ideas-to-alphas has no Rust crate; this is a template artefact. Remove it (or replace with the stack that actually applies).

Fix approach

These are all one-template-copied-N-times faults (see estate CI/CD template rot). Preference is to re-sync the three broken workflow files from the current template rather than hand-patch, and drop the misplaced rust-ci.yml. Any edit under .github/workflows/ requires the workflow OAuth scope, so push over SSH (HTTPS push of workflow files is rejected). Gated behind #1 anyway — until the allowlist PUT lands, the reusable-based workflows still won't start.

Acceptance

• Owner runs the allowlist PUT (ci: bump actions/upload-artifact SHA to current v4 #1); the 6 startup_failure runs clear
• dogfood-gate.yml and workflow-linter.yml parse and run
• e2e.yml either defines a real job or is removed
• rust-ci.yml removed (or replaced with the applicable stack)
• main CI is green (or every remaining red is a real, tracked failure)