ci: declare least-privilege token scope for the estate audit workflow

[arena-ai-coding-agent]

Follow-up to #91. #91 is already merged, so this is a separate PR, and it is
not being merged by me — see "Merge authorization" below.

Why this is only a one-line-class change

Recon of the nine startup_failure runs on #91 concluded that no workflow
file in this repository is defective, so there was nothing to repair there.
The one real, provable workflow/permissions defect found is a missing
GITHUB_TOKEN scope declaration.

The change

main-estate-audit.yml was the only workflow in .github/workflows/ with no
permissions: block, so its token inherited the repository-default scopes.

All 27 steps are shell gates over the checked-out working tree. I read the
action.yml of the cicd-suite composite actions it calls (at the pinned
5a10b72e…) and none of them take a token or call the GitHub API. So
contents: read is the complete grant. This brings the file in line with the
other 15 workflows in the directory.

Verification

• Official GitHub Actions workflow JSON Schema: 16/16 workflows pass.
• actionlint 2.0.6 (WASM build, since the release binary host is blocked in
  this sandbox): no new findings.
• bash -n over all 10 shell scripts: pass.
• tests/source_smoke_test.sh: PASS=68 FAIL=0 SKIP=4 (rc 0).
• tests/aspect/security_test.sh: PASS=62 FAIL=0 SKIP=0 (rc 0).
• tests/binding_inventory.sh: rc 0.

Diagnostics for the maintainer (not fixed here — see PR description thread)

1. startup_failure on all nine Audit evidence claims and disable unsupported product paths #91 pull_request runs is not a content
   defect. Every run has total_count: 0 jobs (also with filter=all) and
   no check-run, so no YAML, action, or permission was ever evaluated. The
   same workflow blobs (git rev-parse identical) ran normally three minutes
   later on the merge to main. Repo-wide there are 243 startup_failure
   runs across push, pull_request, and schedule, and in mixed bursts the
   same file both succeeds and startup-fails (2026-09-20T00:09:03Z: Mirror +
   Secret Scanner succeeded while 8 others failed). This is an Actions
   admission/service failure and needs escalation to GitHub Support, not a
   content change.
2. Reruns were refused for lack of token scope, not because the runs are
   un-rerunnable. POST /actions/runs/{id}/rerun returns
   403 Resource not accessible by integration; /actions/permissions and
   /branches/main/protection return 403 as well. The app token is missing
   actions: write.
3. Pre-existing red on main, unrelated to Audit evidence claims and disable unsupported product paths #91. I reproduced the
   code-hygiene gate locally (identical 19 findings on ci: retire the dead A2ML validation gate #90's tree and on
   Audit evidence claims and disable unsupported product paths #91's). They are 6 OSPF STUB LSA-type constants in bindings/*/ospf.*
   (domain false positives), 2 self-matches in
   scripts/maintenance/run-maintenance.sh, and 11 genuine untracked
   TODO(scope): markers in protocols/*. Resolving or allowlisting those is
   a governance decision, so I did not touch it.
4. Other failing checks on main (annotations, not logs — log blobs are
   behind hosts this sandbox cannot reach): Instant Sync = Bad credentials;
   Hypatia = Path does not exist: hypatia.sarif; panic-attack = exit 128
   with /tmp/panic-findings.json never written.

Toolchain limits, stated plainly

idris2 and zig could not be run here, so no compiler-backed evidence is
produced by this PR. ziglang.org and the apt mirrors are unreachable from
this sandbox, and the only Zig obtainable via the npm registry is 0.14.0-dev,
which fails on std.Build.addLibrary (a 0.15 API, the version CI pins). The
Idris2 bootstrap needs Chez Scheme and gmp.h, and neither apt nor
ftp.gnu.org is reachable. tests/e2e.sh therefore did not run; the
source-pattern suites above are all that did.

Merge authorization

Not merging. #91 was merged by hyperpolymath at 2026-09-27T04:42:30Z, and I
have no authorization to merge this follow-up myself. It should be merged by
a maintainer after review.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d1ac3e35-69fa-435d-8b3d-60195847bcdd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[arena-ai-coding-agent]

Controlled reproduction: startup_failure is content-independent

Opening this PR reproduced the #91 failure exactly, which settles the diagnosis.

This PR changes one block in one file (.github/workflows/main-estate-audit.yml,
permissions: contents: read). It does not touch CodeQL, Secret Scanner,
Hypatia, Governance, Repository Static Checks, or Selected Package Tests.

Result on head 52be7ce1:

workflow	#91	#92
Selected Package Tests	startup_failure	startup_failure
Repository Static Checks	startup_failure	startup_failure
Secret Scanner	startup_failure	startup_failure
CodeQL Security Analysis	startup_failure	startup_failure
Hypatia Security Scan	startup_failure	startup_failure
Governance	startup_failure	startup_failure
Dependabot Auto-Merge	startup_failure	startup_failure
Central Estate CI/CD Audit	startup_failure	startup_failure

8 of 8 eligible pull_request workflows failed — a 100% failure rate, with a
diff that cannot explain it. (The 9th on #91, panic-attack / unified-api-adapter, is paths:-gated on
connectors/proven-nesy-solver-api/zig/**, which this PR does not touch, so it
correctly did not trigger.)

Additional evidence that no job ever ran:

• total_count: 0 for all 8 check suites, and 0 for
  /actions/runs/{id}/jobs?filter=all.
• started_at: null and completed_at: null on all 8 suites.
• No check-run records on the head SHA — only the third-party apps
  (CodeFactor, GitGuardian, Semgrep) produced check-runs at all.

The two most conclusive data points are Repository Static Checks and
Selected Package Tests. Both are trivial — actions/checkout, bash -n
over shell scripts, and the two source-pattern suites that pass locally
(68/0/4 and 62/0/0). They succeeded on the push to main three minutes
after #91's identical runs startup-failed, and they startup-failed here. A
file that only runs bash -n cannot be rejected by an Actions admission
layer.

Reruns

POST /actions/runs/{id}/rerun → 403 Resource not accessible by integration.
/actions/permissions and /branches/main/protection → 403 too. The app
token lacks actions: write; this is a token-scope limit, not a property of
the runs.

Recommended next step

This should go to GitHub Support as an Actions admission failure on this
repository, with the table above as the reproduction. I am not treating it as a
content defect and have deliberately not changed workflow content to chase it.