fix(ci): use the canonical Scorecard wrapper instead of a local copy

[hyperpolymath]

The staleness gate rejects ANY workflow containing both
ossf/scorecard-action@ and github/codeql-action/upload-sarif@, whatever
its triggers. 273 of 302 estate repos already call standards'
scorecard-reusable.yml, which reports with results_format: json +
publish_results: true and never uploads SARIF to Code Scanning.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

💡 Need a hand with PR review? Try Gitar by Sonar!

[github-actions]

🔍 Hypatia Security Scan

Findings: 22 issues detected

Severity	Count
🔴 Critical	0
🟠 High	12
🟡 Medium	10

View findings

[
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): TokenPermissionsID -- Token-Permissions -- 0 day(s) old",
    "type": "CSA001",
    "file": ".github/workflows/scorecard.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/unpinned_action -- Hypatia workflow_audit: unpinned_action -- 2 day(s) old",
    "type": "CSA001",
    "file": "pages.yml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/unpinned_action -- Hypatia workflow_audit: unpinned_action -- 2 day(s) old",
    "type": "CSA001",
    "file": "pages.yml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/unpinned_action -- Hypatia workflow_audit: unpinned_action -- 2 day(s) old",
    "type": "CSA001",
    "file": "pages.yml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/unpinned_action -- Hypatia workflow_audit: unpinned_action -- 2 day(s) old",
    "type": "CSA001",
    "file": "pages.yml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): BranchProtectionID -- Branch-Protection -- 26 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/missing_timeout_minutes -- Hypatia workflow_audit: missing_timeout_minutes -- 26 day(s) old",
    "type": "CSA001",
    "file": "push-email-notify.yml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): FuzzingID -- Fuzzing -- 33 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): SASTID -- SAST -- 33 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence