fix(security): scorecard job permissions, dispatch secret-gate, .envrc placeholder

.envrc

@@ -18,7 +18,7 @@ if has nix && [ -f flake.nix ]; then
 fi
 
 # Project environment variables
-export PROJECT_NAME="{{PROJECT_NAME}}"
+export PROJECT_NAME="wokelangiser"
 export RSR_TIER="infrastructure"
 # export DATABASE_URL="..."
 # export API_KEY="..."

.github/workflows/instant-sync.yml

@@ -15,8 +15,15 @@ jobs:
   dispatch:
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    # Presence-gate: `secrets` can't be referenced directly in `if:`, so the
+    # token is mapped to a job-level env var the steps guard on. On forks
+    # (where FARM_DISPATCH_TOKEN is unset) the dispatch is skipped instead of
+    # firing with an empty token.
+    env:
+      FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
     steps:
       - name: Trigger Propagation
+        if: ${{ env.FARM_DISPATCH_TOKEN != '' }}
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}
@@ -31,4 +38,5 @@ jobs:
             }
 
       - name: Confirm
+        if: ${{ env.FARM_DISPATCH_TOKEN != '' }}
         run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"

.github/workflows/scorecard.yml

@@ -12,5 +12,13 @@ permissions: read-all
 
 jobs:
   analysis:
+    # Least-privilege scopes for the OpenSSF Scorecard reusable workflow
+    # (was inheriting the top-level read-all, which can't grant the writes
+    # publishing needs). Caps what the reusable workflow can request.
+    permissions:
+      contents: read
+      security-events: write
+      id-token: write
+      actions: read
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef
     secrets: inherit