chore(scorecard-reusable): align example with canonical weekly schedule + document drift (#230)

## Summary

Estate audit (2026-05-28) found **180 repos running scorecard daily** at
04:00 UTC (`'0 4 * * *'`) vs **29 on the canonical weekly schedule**
(`'23 4 * * 1'`). The actual canonical caller at
`hyperpolymath/standards/.github/workflows/scorecard.yml` has always
been weekly — the drift was driven by the example block in this
reusable's header still documenting daily.

This PR is the **upstream first cut** of the GH Actions budget
rebalancing plan (2026-05-27):
- Fixes the example to match the canonical weekly schedule
- Adds an explicit note explaining the convention so future deployments
inherit weekly rather than re-introducing daily

## Budget impact (existing drift)

180 daily × (365 − 52) ≈ 56k extra runs/year × ~1.5 min/run ≈ **~84k
Actions-minutes/year** on scorecard alone.

This PR alone changes 1 line of cron in a doc-comment + adds an
explanatory block. The actual estate fan-out (converting the 180
daily-scheduled repos to weekly) is tracked separately as cut 2.

## Test plan

- [x] No behavioural change to the reusable workflow (only comments +
example modified)
- [x] Canonical caller `.github/workflows/scorecard.yml` already uses
`'23 4 * * 1'`; this PR aligns the docs

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/scorecard-reusable.yml

@@ -36,7 +36,7 @@
 #     push:
 #       branches: [main, master]
 #     schedule:
-#       - cron: '0 4 * * *'
+#       - cron: '23 4 * * 1'   # Weekly (Monday 04:23 UTC) — match canonical
 #     workflow_dispatch:
 #   concurrency:
 #     group: ${{ github.workflow }}-${{ github.ref }}
@@ -49,6 +49,23 @@
 #         security-events: write
 #         id-token: write
 #       uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@<sha>
+#
+# CANONICAL SCHEDULE — WEEKLY, NOT DAILY (2026-05-28).
+# Estate audit found 180 repos running daily at 04:00 UTC ('0 4 * * *')
+# vs 29 on canonical weekly ('23 4 * * 1') — drift driven by an older
+# version of the example above. The actual canonical caller in
+# `hyperpolymath/standards/.github/workflows/scorecard.yml` has always
+# been weekly. The example now matches.
+#
+# GH Actions budget impact of the drift: 180 daily × (365 − 52) ≈ 56k
+# extra runs/year × ~1.5 min/run ≈ ~84k Actions-minutes/year. Fan-out
+# to convert the 180 estate repos from daily→weekly is tracked
+# separately (GH-Actions budget rebalancing 2026-05-27).
+#
+# When to deviate: a repo with a very high merge/push cadence AND
+# scorecard-sensitive supply-chain churn (heavy dependency refresh)
+# MAY opt into more frequent runs. Daily is rarely worth it; the
+# scorecard signal moves on the order of weeks, not hours.
 
 name: Scorecard (reusable)