CI: four non-required checks red on main (clippy/fmt, workflow linter, allowlist preflight, DEED validation)

Four non-required checks fail on main (6ea7b12, runs of 2026-10-01). They were surfaced while reviewing #300, which does not cause them:

Check context	Failure on `main`
`rust-ci / Cargo check + clippy + fmt`	job 110437090859 fails in the clippy/fmt step
`governance / Workflow security linter`	a workflow file is missing an SPDX header or a top-level `permissions:` block
`governance / Allowlist Preflight`	`ERROR: could not read live Actions permissions for .github/workflows` (exit 3)
`Validate DEED manifests`	`Missing required identity field (agent-id, name, or project)`

Acceptance criteria

Each of the four contexts above concludes success (or an intended neutral/skipped) on a fresh main push.
For the Allowlist Preflight, it is established whether exit 3 is a token-scope limitation; if it is, the step reports it as a skip with a reason rather than a failure.
The workflow linter names the offending file, and that file gains SPDX and permissions:.

🤖 Generated with Claude Code