fix(ci): bump scorecard-action v2.4.0 to v2.4.4 for ghcr image

[toor11]

Summary

The scheduled OpenSSF Scorecard run fails at image pull: gcr.io/openssf/scorecard-action:v2.4.0 is rejected (denied: This API method requires billing to be enabled). Bumping the pinned ossf/scorecard-action from v2.4.0 to v2.4.4 moves the resolved image to ghcr.io/ossf/scorecard-action:v2.4.4, which is not affected. Failing run: https://github.com/toor11/Decepticon/actions/runs/34838686183

Changes

• .github/workflows/scorecard.yml: ossf/scorecard-action 62b2cac (v2.4.0) -> 2d11466 (v2.4.4). One line, no other change.

Intent

• Issue / ADR this satisfies: scheduled Scorecard failure, run 34838686183 (no existing issue; the run log is the report).
• Anti-goal (one thing this PR could have done but deliberately does not): does not touch any other pinned action, does not disable the schedule or publish_results.

Blast radius

• Tier-auto — tests, internal refactors, non-policy docs, lockfile-only dep bumps.
• Tier-delegate — agent prompts, skill bodies, middleware internals, web/CLI features.
• Tier-supply-chain — CI/workflows, package manifests and lockfiles, install script, compose / Dockerfiles, plugin contracts, .semgrep/**. Reaches every OSS user on the next release: request a review and wait for it.

Why this touches a supply-chain surface: .github/workflows/scorecard.yml executes third-party code (ossf/scorecard-action container image) on every schedule/push to main. This PR changes exactly which published image digest runs there (gcr.io -> ghcr.io via the v2.4.4 pin) and nothing else; the diff is one uses: line.

Diff budget

• My diff fits the budget. (1 line in .github/**, which is excluded from runtime-code counting; 1 logical concern.)

End-to-end verification

I could not execute the Scorecard job locally: it requires a GitHub-hosted runner plus OIDC (id-token: write, publish_results: true), which has no local equivalent. What I did instead, on the exact pushed tree: parsed the edited workflow with yaml.safe_load (OK, uses resolves to the new pin); fetched action.yaml at both pins and confirmed the old pin declares image: docker://gcr.io/openssf/scorecard-action:v2.4.0 (the exact string in the failure log) while the new pin declares image: docker://ghcr.io/ossf/scorecard-action:v2.4.4; read the full git diff (one line). The full Scorecard run is observable via CI / workflow_dispatch after push. actionlint/yamllint are not installed here, so no lint claim is made.

Testing

• make quality passes (Python + CLI + Web)
• make smoke succeeds (clean local build + OSS-style up + health checks)
• pytest tests/ passes (run this if you touched docker-compose.yml or tests/)
• Every new/changed test was watched to fail without the change and pass with it
• Every new/changed code path was executed on my machine, not just unit-tested in isolation
• Manual testing (describe): YAML parse of the edited workflow passes; action.yaml image-ref comparison at old vs new pin confirms gcr.io -> ghcr.io (see above). make quality / pytest were not run: workflow-only change, no Python/CLI code touched.

Quality Bar self-check

• No banned pattern appears in the diff (one uses: pin line; no code).
• No AI-slop signature survives (one pin bump, no prose added to the repo).
• Every changed line traces to the stated intent. No drive-by formatting, renaming, or reordering.
• Every public function I added/changed has explicit type annotations including return type, and every raised exception is a named class. (N/A: no functions added or changed.)
• I would merge this PR if a stranger opened it.
• If I were tired and reviewing this at the end of a long day, I would still merge it.

AI-assisted contribution attestation

By opening this PR, you confirm — whether or not AI assistance was used — that you followed CONTRIBUTING_AGENT.md and meet the QUALITY_BAR.md:

• You read the diff in full and can defend every line on demand.
• You actually ran the verification you ticked above.
• You did not bundle unrelated work.
• You did not weaken offensive-security guard rails (RoE, SafeCommand, EngagementContext, OPSEC skills, semgrep rules, compose isolation, capability / PID / memory limits) without a linked ADR.
• You materially edited any AI-generated output before pushing — the diff is not raw model output.

No checkbox is required for this section. The bar applies whether or not you disclose tool use; this section exists so the expectation is visible at the point of contribution.

Related Issues

Scheduled run failure: https://github.com/toor11/Decepticon/actions/runs/34838686183