chore(ci): make Scorecard periodic, not per-push - #59

Scorecard measures the REPOSITORY's supply-chain posture, not the change under
review. The estate's signal-discipline standard puts repository-level
measurements in the PERIODIC tier: on a schedule against the default branch,
feeding one dashboard — not on every event.

Measured across 303 scorecard workflows before this sweep:

  199  push, schedule, workflow_dispatch
   93  branch_protection_rule, schedule, push
    1  push, pull_request, schedule, workflow_dispatch
    1  schedule, workflow_dispatch                        <- the target shape

So roughly 292 repositories ran a full posture scan on EVERY push to the
default branch. That is pure cost: a supply-chain score cannot meaningfully
change between two consecutive merges, and it never gated anything.

WHAT IS DELIBERATELY KEPT:

  schedule                the point of the tier
  workflow_dispatch       manual re-run when one is actually wanted
  branch_protection_rule  event-driven re-measurement of precisely what
                          Scorecard scores. It fires on a settings change, not
                          per pull request, so it does not violate the PERIODIC
                          rule — and it keeps the score honest after exactly
                          the change most likely to alter it.

Only `push` and `pull_request` are removed. `pull_request` existed in one
repository and was the genuine violation; `push` was the cost.

Related, and the reason this matters beyond minutes: Scorecard was ALSO
required as a `code_scanning` tool in 78 repositories at alertsThreshold=all,
while producing code-scanning results in essentially none — because it does not
emit per-commit SARIF. That made it an estate-wide merge blocker asking to do
something it does not do. Those requirements have been removed separately.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>