CI: 2 red check(s) on the default branch, deferred from #76

[hyperpolymath]

What

PR #76 (the D243 Secret-Scan-Floor caller) changes only .github/workflows/secret-scanner.yml. Its head showed the red checks below. None of them is a required context. Each diagnosed cause below is repository-wide: it fires on files or settings the PR did not change. A cause marked undiagnosed has not been checked, and it is not claimed to be unrelated to the PR. They are deferred here rather than fixed in #76, per the standing owner ruling (2026-09-15) that a finding outside a PR's change becomes an issue with acceptance criteria, not a merge blocker.

• ReScript/Deno CI / build: Cause not diagnosed here; read the failing job log on a fresh default-branch run.
• Governance / governance / Workflow security linter: Cause not diagnosed here; read the failing job log on a fresh default-branch run.

Acceptance criteria

• ReScript/Deno CI / build concludes success (or a deliberate neutral/skipped) on a fresh run of the default branch, or the change that retires it is linked here with its reason.
• Governance / governance / Workflow security linter concludes success (or a deliberate neutral/skipped) on a fresh run of the default branch, or the change that retires it is linked here with its reason.

Context: hyperpolymath/standards#1108 (D243 phase 2).

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

[hyperpolymath]

Root cause tracked estate-wide: the lint-workflows / Workflow security linter SPDX red is hyperpolymath/standards#727. The fix already exists upstream (rsr-template-repo workflow-linter.yml scans the leading comment block; the standards reusable has had it since 13cb62ac), but this repo carries a stale copy or pin. Closing this item means adopting the template's linter step and bumping the governance-reusable pin past 13cb62ac.

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK