test: PR build (#1)

* test: PR build

* ci(docker): grant actions:read so SARIF upload can call workflow-runs API

codeql-action/upload-sarif calls GET /actions/runs/:id to attach
results to the run. Without actions:read it 403s ("Resource not
accessible by integration") and the scan job fails after Trivy
already produced the SARIF.

Add actions: read to both build-scan and rescan-latest job permissions.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Jonn Smith <11667487+jonn-smith@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jonn-smith

.github/workflows/docker.yml

@@ -108,6 +108,7 @@ jobs:
       contents: read
       packages: write
       security-events: write
+      actions: read
     strategy:
       fail-fast: false
       matrix:
@@ -299,6 +300,7 @@ jobs:
       contents: read
       packages: read
       security-events: write
+      actions: read
     strategy:
       fail-fast: false
       matrix:

docker/hvp-monolith/Dockerfile

@@ -22,3 +22,5 @@ COPY LICENSE /opt/hvp-lr/LICENSE
 
 # Set working directory
 WORKDIR /data
+
+# noop