[Maintenance] CI/CD: OSSF Scorecard adoption (automated security-posture scoring)

[Chris-Wolfgang]

Scope

OSSF Scorecard is a purpose-built tool that automatically scores a repo's security posture against ~20 best practices (branch protection, signed commits, pinned dependencies, vulnerability response time, dangerous-workflow patterns, etc.) and produces a 0-10 score. Different from CodeQL / SAST — Scorecard scores the repo configuration, not the code.

Acceptance criteria

• .github/workflows/scorecard.yml runs the OSSF Scorecard action on a weekly schedule + on push to main.
• The workflow publishes results to the GitHub Security tab (via SARIF upload) so they appear alongside CodeQL alerts.
• A badge in README.md shows the current score.
• A documented score floor: PRs that drop the score below threshold (e.g. 7.5) trigger reviewer attention via a CHANGELOG note.
• A baseline scan documents the initial score and known acceptable findings.

Notes

• Tier-1 follow-up. Complementary to CodeQL (S1) and the SAST tool issue from round 1.
• Effort: small. The action is a single drop-in.
• Originated as part of the IAsyncEnumerable-Extensions thorough-review pass; tracked fleet-wide.
• Board: https://github.com/users/Chris-Wolfgang/projects/6