scorecard.yml template violates the estate's own Scorecard/SARIF policy as distributed

[hyperpolymath]

Summary

The governance staleness check enforces:

OSSF Scorecard must not upload SARIF to GitHub Code Scanning unless it runs for every PR
head commit.

The scorecard.yml that appears across estate repos violates it as distributed: it
triggers on push/schedule/workflow_dispatch — never pull_request — yet runs
github/codeql-action/upload-sarif. So the template itself puts every repo that copies it
into permanent violation of a policy enforced against that same repo.

Per the estate "fix each template once" doctrine, this looks like a template fix rather
than N repo fixes.

Evidence

hyperpolymath/gnpl → Governance → Check Workflow Staleness:

##[error]OSSF Scorecard must not upload SARIF to GitHub Code Scanning unless it runs for
every PR head commit.
##[error]Remove legacy scorecard-enforcer.yml, refresh out-of-window standards reusable
pins toward a recent commit, and keep Scorecard out of GitHub Code Scanning unless it runs
for every PR head commit.

The offending shape (verbatim from gnpl before the fix):

on:
  push:
    branches: [main, master]
  schedule:
    - cron: '0 4 * * *'
  workflow_dispatch:
# ... no pull_request trigger ...
      - name: Upload results
        uses: github/codeql-action/upload-sarif@... 
        with:
          sarif_file: results.sarif

This file is clearly template-distributed — copies with the same upload-sarif step exist
throughout the estate (in this repo alone: rhodium-standard-repositories/, k9-svc/ and
its bindings/{rust,haskell,deno}, pandoc/, editors/vscode/, 0-ai-gatekeeper-protocol/,
meta-a2ml/, axel-protocol/, …).

Why the policy is right

Uploading from a schedule/push-to-main run means Code Scanning shows findings that
correspond to no PR head commit, and PR checks appear to carry security results they do
not. Worth keeping.

Fix applied locally in gnpl (offered as the template shape)

Keep the scan, drop the Code Scanning upload; retain the SARIF as a build artifact, and
drop the now-unneeded security-events: write:

      # NOT github/codeql-action/upload-sarif — see policy note.
      - name: Upload results as artifact
        uses: actions/upload-artifact@... # v4
        with:
          name: scorecard-results
          path: results.sarif
          retention-days: 30

After this, scripts/check-workflow-staleness.sh . reports "All workflow staleness checks
passed." (verified locally against standards HEAD 8813ecf).

The alternative — adding a pull_request trigger so it does run for every PR head commit —
is worse in practice: scorecard-action is limited on PR events and SARIF upload from fork
PRs fails.

Scope

Template-level. Not asking for per-repo fixes; gnpl is already handled
(hyperpolymath/gnpl#6). Related upstream reports from the same pass: #516 (Hypatia
ImageOS=ubuntu24), #517 (check-trusted-base.sh Lean false positives).