fix(ci): split scorecard job to satisfy OpenSSF publish-results job-shape rule

The scorecard job has been failing on every push to main since at least
2026-07-01 with "scorecard job must only have steps with `uses`" — the
OpenSSF scorecard-action's publish_results endpoint rejects any job that
mixes non-`uses` steps in with the scorecard-action step. Move the
min-score shell check into a separate downstream job that consumes the
results via artifact upload/download instead of running in-job.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/scorecard-enforcer.yml

@@ -30,6 +30,20 @@ jobs:
           results_format: json
           publish_results: true
 
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: scorecard-results
+          path: results.json
+          retention-days: 5
+
+  check-score:
+    needs: scorecard
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: scorecard-results
+
       - name: Check minimum score
         run: |
           # Parse score from results.json