fix(ci): retire scorecard-enforcer.yml, adopt canonical scorecard.yml (#159)

`scorecard-enforcer.yml` is retired estate-wide (governance's
`check-workflow-staleness.sh` flags its presence, and OSSF Scorecard
must not upload SARIF to Code Scanning unless it runs for every PR head
commit — the enforcer's push+schedule-only trigger doesn't). Replaced
with the canonical `scorecard.yml` → standards `scorecard-reusable.yml`
pattern (matches what other repos already run).

---------

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

Author: hyperpolymath

.github/workflows/scorecard.yml

@@ -1,16 +1,33 @@
 # SPDX-License-Identifier: MPL-2.0
-name: Scorecards supply-chain security
-
+name: OSSF Scorecard
 on:
-  branch_protection_rule:
-  schedule:
-    - cron: '23 4 * * 1'
   push:
-    branches: [main]
+    branches: [main, master]
+  schedule:
+    - cron: '0 4 * * *'
+  workflow_dispatch:
 
 permissions: read-all
 
 jobs:
   analysis:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7c9db0e5909aab77bf11a444ade3b95c1d2b702e
-    secrets: inherit
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run Scorecard
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+
+      - name: Upload results
+        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.31.8
+        with:
+          sarif_file: results.sarif