chore(ci): make Scorecard periodic — drop push and pull_request triggers

[hyperpolymath]

Scorecard measures the REPOSITORY's supply-chain posture, not the change under review. The estate's signal-discipline standard puts repository-level measurements in the PERIODIC tier: on a schedule against the default branch, feeding one dashboard — not on every event.

Measured across 303 scorecard workflows before this sweep:

199 push, schedule, workflow_dispatch
93 branch_protection_rule, schedule, push
1 push, pull_request, schedule, workflow_dispatch
1 schedule, workflow_dispatch <- the target shape

So roughly 292 repositories ran a full posture scan on EVERY push to the default branch. That is pure cost: a supply-chain score cannot meaningfully change between two consecutive merges, and it never gated anything.

WHAT IS DELIBERATELY KEPT:

schedule the point of the tier
workflow_dispatch manual re-run when one is actually wanted
branch_protection_rule event-driven re-measurement of precisely what
Scorecard scores. It fires on a settings change, not
per pull request, so it does not violate the PERIODIC
rule — and it keeps the score honest after exactly
the change most likely to alter it.

Only push and pull_request are removed. pull_request existed in one repository and was the genuine violation; push was the cost.

Related, and the reason this matters beyond minutes: Scorecard was ALSO required as a code_scanning tool in 78 repositories at alertsThreshold=all, while producing code-scanning results in essentially none — because it does not emit per-commit SARIF. That made it an estate-wide merge blocker asking to do something it does not do. Those requirements have been removed separately.

Summary

Changes

RSR Quality Checklist

Required

• Tests pass (just test or equivalent)
• Code is formatted (just fmt or equivalent)
• Linter is clean (no new warnings or errors)
• No banned language patterns (no TypeScript, no npm/bun, no Go/Python)
• No unsafe blocks without // SAFETY: comments
• No banned functions (believe_me, unsafeCoerce, Obj.magic, Admitted, sorry)
• SPDX license headers present on all new/modified source files
• No secrets, credentials, or .env files included

As Applicable

• .machine_readable/descriptiles/STATE.a2ml updated (if project state changed)
• .machine_readable/descriptiles/ECOSYSTEM.a2ml updated (if integrations changed)
• .machine_readable/descriptiles/META.a2ml updated (if architectural decisions changed)
• Documentation updated for user-facing changes
• TOPOLOGY.md updated (if architecture changed)
• CHANGELOG or release notes updated
• New dependencies reviewed for license compatibility (MPL-2.0 / MPL-2.0)
• ABI/FFI changes validated (src/interface/abi/ and src/interface/ffi/ consistent)

Testing

Screenshots

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud