ci(governance): refresh standards pins, drop retired scorecard-enforcer

Resolve the `governance / Check Workflow Staleness` failure:
- delete .github/workflows/scorecard-enforcer.yml (retired; standards now uses
  scorecard.yml -> scorecard-reusable.yml). Also clears the Hypatia
  workflow_audit findings scorecard_publish_with_run_step + the SARIF-to-Code-
  Scanning flag, which lived in that file.
- bump governance.yml and scorecard.yml standards-reusable pins from
  @main / @e0caf115 to the current standards SHA @5a93d9d5 (SHA-pinned, per the
  repo's "all actions SHA-pinned" convention).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LvsZgNxFbeqfRmrVFNhJ8G

Author: claude