OpenSSF Scorecard publishes supply-chain posture and surfaces hardening gaps

## User story

As a **maintainer**, I want **OpenSSF Scorecard to grade the repo's supply-chain posture** so that **I get a concrete checklist of hardening steps (pin actions by SHA, branch protection, tokenless publish, etc.) instead of working from memory**.

## Why

Scorecard is the industry-standard self-assessment for open-source supply-chain hygiene. It surfaces exactly the hardening work this plan is doing, and publishes a badge + report so downstream packagers can see the posture improving.

## Acceptance criteria

- [ ] `.github/workflows/scorecard.yml` exists using `ossf/scorecard-action`.
- [ ] Runs on `branch_protection_rule`, `push` to `main`, and weekly.
- [ ] Publishes results to the Security tab (uploads SARIF).
- [ ] Scorecard badge is added to the top of README.
- [ ] Initial findings are reviewed; items already covered by other issues are cross-referenced, new items get their own issues filed.

## Out of scope

- Scoring publicly on `deps.dev` (automatic after first run).

## Notes

- Target release: **none — chore**
- Source: modernization assessment §4.