Address filed configuration and doc defects

[ptr727]

• configure.sh: drop 2>/dev/null in check_security so gh's error surfaces (matches check_secrets).
• WORKFLOW.md D7.2/section 2: reword so it no longer claims reusable tasks declare permissions (they run under the caller's least-privilege grant).

Closes #359

Validation: shellcheck + actionlint + markdownlint clean; line endings preserved.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR addresses a small but important diagnostics gap in the repository configuration audit script and corrects/clarifies workflow documentation around reusable workflow permissions, aligning the docs with GitHub Actions’ caller-scoped permission model.

Changes:

• repo-config/configure.sh: stop suppressing gh api stderr in check_security() so auth/API failures surface clearly (matching the hardened behavior used elsewhere in the script).
• WORKFLOW.md: reword the reusable-workflow permissions guidance (section 2 and D7.2) to avoid implying the callee “declares” permissions, and instead reflect that the caller grants least-privilege permissions at the uses: job.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
WORKFLOW.md	Clarifies reusable workflow permissions behavior and the “skipped jobs still need valid permissions” rule wording.
repo-config/configure.sh	Removes 2>/dev/null from the automated-security-fixes audit call so gh errors are visible and actionable.