fix(ci): add SPDX header to pages.yml; remove retired scorecard-enforcer.yml

Two of the governance gate's failures, both surfaced only after the repository's
Actions policy was fixed (the workflows previously startup_failure'd before any
job could run).

Workflow security linter
  ERROR: .github/workflows/pages.yml missing SPDX header

  pages.yml is the active Ddraig SSG docs deploy added in #288; it was the only
  workflow of 26 without the header. Added, matching the form used by
  proofs.yml. Not deleted — it is live, and pages-deploy.yml is a different
  thing (Cloudflare Workers, not GitHub Pages).

Check Workflow Staleness
  ERROR: scorecard-enforcer.yml is retired. Use scorecard.yml ->
         standards scorecard-reusable.yml instead.

  Removed. The replacement scorecard.yml is present. This also clears the
  separate `OpenSSF Scorecard Enforcer` run failure.

  Confirmed safe to delete: the Base ruleset (14285163) requires only
  `Dependabot`, `Hypatia Neurosymbolic Analysis` and `Hypatia`, so removing
  this workflow cannot strand a PR on a permanently-"Expected" required check.

Deliberately NOT addressed here — the staleness gate's two remaining complaints
both concern shared CI fate and want coordination, not a drive-by fix:

  - governance-reusable.yml / scorecard-reusable.yml pin d135b05bfc64 is 75
    commits / 26d behind standards HEAD (refresh toward 8813ecf2a841).
    Re-pinning consumers changes behaviour estate-wide, and at least one
    reusable (secret-scanner) is known not to inherit its config to callers.
  - OSSF Scorecard uploading SARIF to Code Scanning while not running for every
    PR head commit.

Verified locally by replicating the linter's own check across all 25 remaining
workflows: every one carries an SPDX header and a top-level `permissions:`.
pages.yml still parses as valid YAML.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/pages.yml

@@ -1,3 +1,8 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# GitHub Pages docs deploy via the Ddraig SSG (#288).
+
 name: GitHub Pages (Ddraig SSG)
 on:
   push: