ci(scorecard-enforcer): split score-threshold from publish job (OSSF run-step ban — 49 repos affected) (#304)

## Summary

Estate CI/CD audit 2026-05-30 caught **49 repos** failing on `OpenSSF
Scorecard Enforcer` with:

```
webapp: scorecard job must only have steps with uses
```

## Root cause

OSSF's publish endpoint enforces a hard contract: the job that runs
`ossf/scorecard-action` with `publish_results: true` must contain ONLY
`uses:` steps. Any `run:` step in the same job — typically a "Check
minimum score" threshold gate — fails the publish step and the whole
workflow run.

## Fix

- `scorecard` job: `uses:`-only (checkout → run-scorecard → upload-sarif
→ upload-artifact). Satisfies OSSF contract.
- New `check-score` job, `needs: scorecard`, downloads the SARIF
artifact and runs the threshold check. `run:` lives here.

Real SHA pins verified via API:
- `actions/upload-artifact@330a01c4` (v5.0.0)
- `actions/download-artifact@018cc2cf` (v5.0.0)

## Fan-out

49 estate repos carry per-repo clones of this file. Single template fix
here; mechanical sweep follows in a separate API content-replace pass.

## Hypatia rule

Companion PR adds WF014 (`scorecard_publish_with_run_step`) so this
pattern is detected automatically going forward. Sensitivity +
specificity smoke-tested:
- Fires on pre-fix shape: ✓
- Does NOT fire on reusable-only (no publish): ✓

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/scorecard-enforcer.yml

@@ -21,6 +21,16 @@ permissions:
   contents: read
 
 jobs:
+  # The OSSF Scorecard publish endpoint enforces a hard contract: the job that
+  # runs `ossf/scorecard-action` with `publish_results: true` must contain
+  # ONLY steps with `uses:` (no `run:` steps in the same job). If a `run:`
+  # step is present, the publish step fails with:
+  #   "webapp: scorecard job must only have steps with uses"
+  # (49 estate repos hit this; see ROADMAP audit 2026-05-30.)
+  #
+  # Fix: split the threshold check into a downstream job that depends on
+  # `scorecard` and consumes the SARIF artifact. The `scorecard` job stays
+  # uses-only; `check-score` is the gating job that emits the error.
   scorecard:
     runs-on: ubuntu-latest
     permissions:
@@ -43,9 +53,26 @@ jobs:
         with:
           sarif_file: results.sarif
 
+      - name: Persist SARIF for downstream score-gate job
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 1
+
+  check-score:
+    needs: scorecard
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Download SARIF from scorecard job
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v5.0.0
+        with:
+          name: scorecard-results
+
       - name: Check minimum score
         run: |
-          # Parse score from results
           SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0")
 
           echo "OpenSSF Scorecard Score: $SCORE"