CI: 1 red check(s) on the default branch, deferred from #65 #66

What

PR #65 (the D243 Secret-Scan-Floor caller) changes only .github/workflows/secret-scanner.yml. Its head showed the red checks below. None of them is a required context. Each diagnosed cause below is repository-wide: it fires on files or settings the PR did not change. A cause marked undiagnosed has not been checked, and it is not claimed to be unrelated to the PR. They are deferred here rather than fixed in #65, per the standing owner ruling (2026-09-15) that a finding outside a PR's change becomes an issue with acceptance criteria, not a merge blocker.

• Governance / governance / Check Workflow Staleness: Cause not diagnosed here; read the failing job log on a fresh default-branch run.

Acceptance criteria

• Governance / governance / Check Workflow Staleness concludes success (or a deliberate neutral/skipped) on a fresh run of the default branch, or the change that retires it is linked here with its reason.

Context: hyperpolymath/standards#1108 (D243 phase 2).

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK