fix(ci): use the canonical Scorecard wrapper instead of a local copy

The staleness gate rejects ANY workflow containing both
`ossf/scorecard-action@` and `github/codeql-action/upload-sarif@`, whatever
its triggers. Deleting the retired `scorecard-enforcer.yml` did not address
this — `scorecard.yml` itself carried the banned pair.

273 of 302 repos already call standards' `scorecard-reusable.yml`, which
reports with `results_format: json` + `publish_results: true` and never
uploads SARIF to Code Scanning. This converges the remaining local copies on
that template rather than leaving bespoke files to drift again.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/scorecard.yml

@@ -1,27 +1,20 @@
 # SPDX-License-Identifier: MPL-2.0
 name: Scorecards supply-chain security
+
 on:
   branch_protection_rule:
   schedule:
     - cron: '23 4 * * 1'
   push:
     branches: [main]
+
 permissions: read-all
+
 jobs:
-  scorecard:
-    runs-on: ubuntu-latest
+  analysis:
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
     permissions:
+      contents: read
       security-events: write
       id-token: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
-      - uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v3.31.8
-        with:
-          sarif_file: results.sarif
+    secrets: inherit