fix(scorecard-enforcer): set publish_results=false to avoid webapp rejection

The scorecard-enforcer job has a 'run:' step (minimum score check)
which violates OSSF scorecard-action's workflow-restriction: when
publish_results=true the webapp validates that the 'scorecard' job
contains ONLY 'uses:' steps, and rejects any 'run:' step with HTTP 400.

Setting publish_results=false skips the webapp publish entirely;
the SARIF is still uploaded via github/codeql-action/upload-sarif for
Code Scanning alerts, and the minimum-score run: step continues to work.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/scorecard-enforcer.yml

@@ -36,7 +36,7 @@ jobs:
         with:
           results_file: results.sarif
           results_format: sarif
-          publish_results: true
+          publish_results: false
 
       - name: Upload SARIF
         uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4