fix(ci): repair workflows made unparseable by a blind permissions insertion

These workflow files are not valid YAML, so they have NEVER run. GitHub
Actions rejects the file before creating any job: the run is recorded as
`failure` with no jobs, no log and no check run, and `gh pr checks` shows no
row at all. A red mark with nothing behind it to read.

The cause is a sweep that added permission declarations by LINE POSITION
rather than by parsing the document. Two invalid shapes resulted.

  permissions: read-all
    actions: read            <- a mapping indented under a SCALAR value

`read-all` is a scalar and cannot take children. It also already grants
everything `actions: read` would, so the orphaned line is dropped and nothing
is lost.

  on:
    permissions: contents: read     <- two colons on one line, and
    push:                              `permissions` is not a valid key here

Dropped entirely.

VERIFIED, not assumed. Every workflow in this repository parses after the
change, and the repairer refuses to write any file that does not parse and
still contain jobs afterwards. Where a job-level permissions line was removed,
a top-level `permissions:` remains and is read-only, so nothing is widened —
and if none remained the tool reports that rather than inventing one, because
guessing a permission set is how you silently over-grant.

ESTATE CONTEXT: 67 repositories and 100 workflow files are in this state.
The most frequently broken file is workflow-linter.yml, in 22 repositories —
the workflow whose job is to lint workflows was itself unparseable, so it
never ran and never caught this.

Detection is being added upstream so it cannot recur invisibly: a strict YAML
loader in the governance reusable (hyperpolymath/standards#582). Ordinary
validation cannot see this class of fault, because yaml.safe_load accepts
duplicate keys and only a full parse catches the malformed indentation.

EXPECT THIS REPOSITORY TO GET LOUDER. Workflows that have been failing
silently will now actually run, and some will find real problems.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

Author: hyperpolymath

.github/workflows/ada.yml

@@ -8,7 +8,6 @@ on:
     branches: [ "main" ]
 
 permissions: read-all
-  actions: read
 
 jobs:
   build:

.github/workflows/codeql.yml

@@ -19,7 +19,6 @@ concurrency:
 
 
 permissions: read-all
-  actions: read
 
 jobs:
   analyze:

.github/workflows/generator-generic-ossf-slsa3-publish.yml

@@ -18,7 +18,6 @@ on:
     types: [created]
 
 permissions: read-all
-  actions: read
 
 jobs:
   build:

.github/workflows/scorecard.yml

@@ -9,7 +9,6 @@ on:
     branches: [main]
 
 permissions: read-all
-  actions: read
 
 jobs:
   analysis:

.github/workflows/workflow-linter.yml

@@ -11,7 +11,6 @@ on:
       - '.github/workflows/**'
 
 permissions: read-all
-  actions: read
 
 jobs:
   lint-workflows: