fix(ci): keep reusable pin token out of scorecard.yml comment

The estate staleness check greps every workflow line for
"scorecard-reusable.yml@" and extracts the SHA after it. The #42 comment
("... declared by scorecard-reusable.yml@d72fe5a.") added a SECOND match,
so the extracted PINNED_SHA became two lines and never equalled the
expected single SHA — a false "stale Scorecard reusable" failure even
though the actual `uses:` pin is correct. Reword the comment to drop the
token, with a NOTE to prevent regression. Verified locally:
check-workflow-staleness.sh@d72fe5a now exits 0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LvsZgNxFbeqfRmrVFNhJ8G

Author: claude

.github/workflows/scorecard.yml

@@ -14,9 +14,12 @@ jobs:
   analysis:
     # Explicit least-privilege permissions for the reusable Scorecard call:
     # contents:read to check out, security-events:write to upload the SARIF,
-    # id-token:write to publish results to the OpenSSF API. Matches the scopes
-    # declared by scorecard-reusable.yml@d72fe5a.
+    # id-token:write to publish results to the OpenSSF API — exactly the
+    # scopes the pinned reusable Scorecard workflow declares.
     # (Hypatia workflow_audit: scorecard_wrapper_missing_job_permissions)
+    # NOTE: do not write the reusable's "<name>.yml@<sha>" string in a comment
+    # here — the estate staleness check greps every line for that token and a
+    # second match would break its single-pin SHA comparison.
     permissions:
       contents: read
       security-events: write