feat(governance): add scorecard-reusable.yml — close 5-candidate convergence set (#205)

## Summary

5th and final reusable in the workflow convergence campaign (see #199
for the meta-doc). Consolidates the per-repo `scorecard.yml` workflow.

## Drift signal (full pagination + per-repo verified)

- **258** top-level estate deployments
- **626** nested copies in monorepos (asdf-tool-plugins,
developer-ecosystem, ssg-collection, standards, ambientops,
julia-ecosystem, etc. — Layer-2 truncation discovery via #204's helper)
- **46** unique blob SHAs / 17.8% structural drift
- Top SHA covers **100/258 (38.8%)** — highest dominant-cluster of the 5
campaigns
- Top 7 SHAs cover ~80%
- **100% mechanical drift, ZERO feature variance** — SPDX header
(PMPL-1.0 / PMPL-1.0-or-later / MPL-2.0), `upload-sarif` SHA-pin churn,
`permissions: read-all` vs `contents: read` wording

## Design

- One input: `runs-on` (default ubuntu-latest)
- No `secrets: inherit` — Scorecard uses `GITHUB_TOKEN` directly
- Caller MUST grant `security-events: write` + `id-token: write` on the
calling job (called-workflow permissions are capped by caller)
- Caller keeps own `on:` triggers + `concurrency:` group

## Per Layer-3 caveat from the campaign meta-doc

Nested workflows are inert — GitHub Actions only runs
`.github/workflows/` at the repo root. Sweeping the 626 nested copies is
single-source-of-truth cleanup, not security hardening.

## Campaign convergence set (closes with this PR)

| PR | Template |
|---|---|
| #187 | mirror-reusable.yml |
| #190 | secret-scanner-reusable.yml |
| #192 | codeql-reusable.yml |
| #193 | hypatia-scan-reusable.yml |
| #194 | sweep-classifier scripts |
| #199 | campaign meta-doc |
| #204 | list-workflow-paths.sh (bypass /search/code undercount) |
| **this** | **scorecard-reusable.yml** |

## Test plan

- [ ] Wrapper sweep (~258 top-level + ~626 nested) — owner-gated; not
part of this PR
- [ ] Update classify-* scripts to consume helper TSV — follow-up

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath

.github/workflows/scorecard-reusable.yml

@@ -0,0 +1,87 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# scorecard-reusable.yml — Reusable OSSF Scorecard analysis.
+#
+# Consolidates the per-repo `scorecard.yml` workflow (estate-wide:
+# 258 top-level deployments, 46 unique blob SHAs, 17.8% structural
+# drift — top SHA covers 100/258 (38.8%), top 7 SHAs cover 80%).
+# Sampled top + long-tail variants are all the same single-`analysis`-
+# job shape (41 lines canonical); 100% of drift is mechanical:
+# SPDX-header lag (PMPL-1.0 / PMPL-1.0-or-later / MPL-2.0),
+# `github/codeql-action/upload-sarif` SHA-pin drift, and
+# `permissions: read-all` vs `permissions: contents: read` wording.
+# Zero feature variance across all 46 SHAs.
+#
+# Plus 626 nested copies in monorepos (asdf-tool-plugins, developer-
+# ecosystem, ssg-collection, standards, ambientops, julia-ecosystem,
+# etc.). Per Layer-3 caveat (see scripts/sweep-classifiers/README.adoc),
+# nested workflows are inert — GitHub Actions only runs the repo-root
+# `.github/workflows/` directory. Sweeping nested copies is
+# single-source-of-truth cleanup, not security hardening.
+#
+# Design:
+#   - One input only: `runs-on` (default ubuntu-latest).
+#   - No `secrets: inherit` needed — scorecard uses `GITHUB_TOKEN`
+#     directly, which is available without inherit.
+#   - Caller MUST grant `security-events: write` and `id-token: write`
+#     on the calling job. The reusable re-asserts these on its own
+#     `analysis` job, but called-workflow permissions are CAPPED by
+#     the caller's permissions block.
+#   - Caller keeps its own `on:` triggers and `concurrency:` group, so
+#     the read-only cancel-superseded behaviour stays in the wrapper.
+#
+# Caller example (wrapper):
+#   # SPDX-License-Identifier: PMPL-1.0-or-later
+#   name: OSSF Scorecard
+#   on:
+#     push:
+#       branches: [main, master]
+#     schedule:
+#       - cron: '0 4 * * *'
+#     workflow_dispatch:
+#   concurrency:
+#     group: ${{ github.workflow }}-${{ github.ref }}
+#     cancel-in-progress: true
+#   permissions:
+#     contents: read
+#   jobs:
+#     scorecard:
+#       permissions:
+#         security-events: write
+#         id-token: write
+#       uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@<sha>
+
+name: Scorecard (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      runs-on:
+        description: Runner label
+        type: string
+        required: false
+        default: ubuntu-latest
+
+permissions:
+  contents: read
+
+jobs:
+  analysis:
+    runs-on: ${{ inputs.runs-on }}
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run Scorecard
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+
+      - name: Upload results
+        uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3.31.8
+        with:
+          sarif_file: results.sarif