Fix CodeQL security alerts

- sched.c: Fix scanf return value check (check != 1 instead of == 0)
  to properly handle EOF condition
- ci.yml: Add explicit permissions block to restrict workflow to
  read-only contents access (security best practice)

Fixes CodeQL alerts nimble-code#27 (incorrectly-checked-scanf) and
nimble-code#30-35 (missing-workflow-permissions)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: montge

.github/workflows/ci.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [master, main]
 
+# Restrict permissions to minimum required
+permissions:
+  contents: read
+
 jobs:
   build-linux:
     runs-on: ubuntu-latest

Src/sched.c

@@ -569,7 +569,7 @@ try_more:	for (X_lst = run_lst, k = 1; X_lst; X_lst = X_lst->nxt)
 		} else
 		{	char buf[256];
 			fflush(stdout);
-			if (scanf("%64s", buf) == 0)
+			if (scanf("%64s", buf) != 1)
 			{	printf("\tno input\n");
 				goto try_again;
 			}