fix(scorecard): inline scorecard steps so OSSF webapp can verify job

The reusable-workflow form caused startup_failure (0 jobs created) with
job name 'scorecard'. Switch to an inline job with only `uses:` steps —
satisfies OSSF scorecard-action's workflow-restriction check (no `run:`
steps, job named 'scorecard'). All three action SHAs are pinned.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/scorecard.yml

@@ -12,8 +12,21 @@ permissions: read-all
 
 jobs:
   scorecard:
+    runs-on: ubuntu-latest
     permissions:
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef
-    secrets: inherit
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3.31.8
+        with:
+          sarif_file: results.sarif