OpenSSF Scorecard runs across the managed repositories, not just zfs-replicate

## Summary

Roll the Scorecard workflow out across the managed repositories, so supply-chain posture is graded everywhere the Terraform baseline applies rather than in one repo that isn't running it yet.

## Motivation

zfs-replicate#414 established the pattern: `ossf/scorecard-action` on `branch_protection_rule`, a weekly cron, and push to the default branch, uploading SARIF to the Security tab. Its PR (zfs-replicate#489) closed unmerged, blocked on that repo's default-branch rename (zfs-replicate#400). So the pattern is written down and running nowhere.

Meanwhile the repos that would take it today have nothing. Checked at filing, none of `blog.alunduil.com`, `alunduil-chezmoi`, `alunduil-infrastructure`, `woodland-generators`, or `claustre` has a file matching `scorecard` under `.github/workflows`. All five are public, all five already default to `main`, and all five consume third-party actions.

That last point is the connection to work already in flight here. #376 is narrowing `allowed_actions` to an allow-list and enumerates twenty-two third-party actions across ten orgs; #372 pinned actions by SHA. Scorecard grades that same surface and would say where the hardening actually stands instead of leaving it to memory.

## Scope

- Decide where the workflow lives: copied into each repo, or emitted from the `github_repository` module alongside the other baseline settings. The module already owns repo-level policy, which argues for emitting it, but a workflow file is a different kind of artifact from a repository setting.
- Land it on the five repos that default to `main`, so nothing waits on zfs-replicate#400.
- Triage the first run's findings. Cross-reference what is already tracked (#376, #372); file the rest.
- Decide whether a Scorecard badge goes in each README, or nowhere.

## Acceptance criteria

- [ ] Scorecard runs on every managed public repo whose default branch is `main`.
- [ ] Results reach each repo's Security tab.
- [ ] First-run findings are triaged — each is cross-referenced to an existing issue or filed as a new one.
- [ ] The rollout mechanism (copied vs Terraform-emitted) is recorded rather than left implicit in whichever way it happened to be done.

## Additional context

zfs-replicate stays blocked on its own default-branch rename; this issue deliberately does not wait for it, and zfs-replicate#414 remains the owner for that repo.

Weigh one ongoing cost: Scorecard grades branch protection, and a low score there is a finding about a deliberate single-maintainer choice, not a gap. Decide up front whether those checks are acted on or accepted, so the report stays worth reading.