fix(ci): split scorecard job to satisfy OpenSSF publish-results job-shape rule (#467)

## Summary
- `scorecard-enforcer.yml` has failed on **every single push to `main`**
since at least 2026-07-01 (verified: last 3+ runs all `failure`), not
from any content problem but from a structural workflow bug.
- The `scorecard` job's actual analysis succeeds (score 7.2/10) but the
publish-results step then fails: `workflow verification failed:
scorecard job must only have steps with \`uses\`` — OpenSSF's
scorecard-action rejects any job for publish that mixes shell `run:`
steps in with the scorecard-action step (anti-tampering restriction, see
ossf/scorecard-action#workflow-restrictions).
- The offending step was the in-job `Check minimum score` shell block.

## Fix
Split the single `scorecard` job into two:
- `scorecard`: checkout → scorecard-action → upload-artifact (all
`uses:` steps only, satisfies OpenSSF's restriction)
- `check-score`: downloads the artifact, runs the existing min-score
shell check unchanged

`check-critical` job is untouched.

## Test plan
- [ ] CI run on this PR shows `scorecard` job green (publish succeeds)
and `check-score` job runs the same min-score logic as before
- [ ] Confirm no regression to the `check-critical` job (SECURITY.md /
pinned-deps check)

## Note
This fixes one of two checks currently red on every push to `main`. The
other, `instant-sync.yml`, fails with `Bad credentials` because
`FARM_DISPATCH_TOKEN` is dead — that's a secret-rotation action only the
owner can take (already tracked in memory as a pending
GitHub-identity-rebuild item: mint `HYPATIA_SCAN_PAT`/`DISPATCH_PAT`,
drop `FARM_DISPATCH_TOKEN`). Flagging here rather than attempting a code
fix for it.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/scorecard-enforcer.yml

@@ -30,6 +30,20 @@ jobs:
           results_format: json
           publish_results: true
 
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: scorecard-results
+          path: results.json
+          retention-days: 5
+
+  check-score:
+    needs: scorecard
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: scorecard-results
+
       - name: Check minimum score
         run: |
           # Parse score from results.json