Improve Scorecard workflow access and action pins

[thinksyncs]

Summary

• wire Scorecard to use when available and fall back to
• add so Scorecard can be rerun on demand
• update Scorecard workflow action pins to current Node 24 compatible SHAs

Why

• helps Scorecard read branch and review policy more reliably
• removes Node 20 deprecation warnings from the Scorecard workflow path

Validation

• reviewed workflow diff locally
• branch pushed to GitHub

[Copilot]

Pull request overview

Updates the repository’s Scorecard GitHub Actions workflow to improve access to branch/review policy data (via an optional PAT) and refresh action pins for Node 24 compatibility, while also enabling manual re-runs.

Changes:

• Add workflow_dispatch so the Scorecard workflow can be run on demand.
• Prefer a fine-grained PAT (SCORECARD_TOKEN) for Scorecard API access, with fallback to the workflow token.
• Update pinned SHAs for actions/checkout, actions/upload-artifact, and github/codeql-action/upload-sarif; mark the related tracking issue as in-progress.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/scorecard.yml	Adds manual trigger, configures token fallback for Scorecard, and updates pinned action SHAs.
.beads/issues.jsonl	Updates the “Node 24 runtime” tracking issue status to in_progress with a new updated_at.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.