fix(repo-standard): one reusable workflow = one authority ceiling (#55)

[bdelanghe]

Problem

repo-standard.yml @ #54 (60745f9b) raised its permission floor above contents: read: the sbom job declares contents: write and scorecard declares actions: read. GitHub validates a called reusable workflow's permission requests as the union of all its jobs, at load time, before any if: — so every caller, even a read-only spell/security PR run, had to grant the superset or get a zero-jobs startup_failure. That's the #55 root cause (confirmed: org allowed_actions: "all", so it was never the Actions allowlist), and why conformance#19 is blocked.

Fix — one reusable workflow = one authority ceiling

Workflow	Ceiling	Jobs
repo-standard.yml	contents: read	osv, dependency-review, spell, test, descriptor
repo-scorecard.yml	contents: read + actions: read	scorecard
repo-release.yml	contents: write	sbom (+ upload-release-assets input)

Because the caller grant is validated as the union of the called workflow's jobs, each distinct ceiling must be its own file — otherwise a scorecard-only caller (scorecard was default: true, i.e. ~every repo) would be forced to grant contents: write. Callers now opt into the elevated ceilings with dedicated, event-gated jobs, so a PR run never instantiates write authority.

Regression guard (closes #56)

repo-standard-selftest.yml calls each reusable workflow at its intended ceiling. GitHub validates the permission union at load time, so a future revision that raises a floor fails here, pre-merge, instead of in every downstream repo — the self-test this repo lacked (which is how #54 shipped green). It also doubles as the reference caller template.

Caller migration (separate PR)

Callers that used scorecard: true / sbom: true inputs move those to dedicated jobs calling repo-scorecard.yml / repo-release.yml. Tracked for conformance in conformance#19; other repos on the old pin are unaffected until they bump.

PR checklist

1. Independent PR — .github reusable-workflow split only; caller adoption (conformance#19) is separate
2. Changed codepaths verified — self-test caller exercises all three ceilings in CI (this PR's own run)
3. Root cause identified — load-time permission union above the contents: read floor (evidence in repo-standard.yml @ #54 fails caller startup: scorecard/sbom actions not in the org Actions allowlist #55)
4. No duplication — jobs moved, not copied; logic unchanged
5. No unrelated changes — no behavior changes to the jobs themselves

Fixes #55. Closes #56. Unblocks conformance#19.

🤖 Generated with Claude Code